# PGP Encryption and signing

There is a requirement for me to both encrypt a file with the clients public key provided to us and sign the same file with our (my own) private key which they have the corresponding public key for.

Should this be a 2 step process (i.e. first encrypt then sign) Or can this be done in one shot using a single PGP command with multiple parameter? If so, can you please provide a sample of what the command would look like?

• You need to encrypt if you want to provide confidentiality, however you can only prove it's from you authentically by signing it - those two are different operations. And forget about command line, use one of these – DannyNiu Apr 4 '18 at 16:59
• Provided you have your keys all configured correctly, you can do this in one command - \$ gpg -se -r <recipients email> <file>. – puzzlepalace Apr 4 '18 at 21:50

Should this be a 2 step process ...

Yes, you need to do it in 2 steps with common algorithms such as RSA, ECDSA, ECIES, etc. (because they're not signcrypt algorithms).

You should first encrypt, then sign, as this ensures with (slightly) better confidence that signature don't reveal information about the file/message.

If so, can you please provide a sample of what the command would look like?

Programming questions are off-topic. But if you really don't know how to use the command line, there is a high chance you can hurt yourself doing it, so a GUI app is recommended.

• Thanks Danny, this is helpful. Just one follow question, Doesn't encrypting then signing change the form of the content in the file twice? Therefore, when the client first decrpyts the file and then verifies the signature the encryption isn't right because the signing changed the form of the file incorrectly? Let me know if any part of my understanding is incorrect. – Evan Ginsberg Apr 4 '18 at 17:42
• If you encrypt the sign, then your client must verify then decrypt. They do it in the reverse direction than you do. – DannyNiu Apr 5 '18 at 5:15
• It's a 2-step process as DannyNiu pointed out, but can be done within one pgp command (sign -u "your private key" -r "recipient's public key" data) – TrinityTonic Apr 5 '18 at 14:09