Is it possible to check if a PGP signed message has been modified when the public key of the signer is not available?
Like, is there a message digest (hash) that can be checked without knowing the public key of the signer?
Note that I am aware that, even if the message digest is okay, it is not possible to prove authenticity. However, what I am asking is if I can discover just the case that the message has been modified (more accidentally than intentionally tampered with).
Basically, I'm asking if I can technically detect a modification of a signed message without the signer's public key.
The reason why I am asking is this scenario:
- I get a message that is signed
- I don't have the signer's public key
- My app tells me that the signer cannot be verified
Now I modify one byte of the message and try again, then
- My app still tells me that the signer cannot be verified
while I would think that, in this scenario, it would be more important to know that the message has been modified.