keybase / keybase/keybase-issues

`keybase sign` and https://keybase.io/sign differ

Open
#268 5 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

When I use https://keybase.io/sign, the result is something like this:

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

This is something. It should be signed.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP JS 0.0.1
Comment: https://keybase.io/crypto

wsFcBAABCgAGBQJTJuORAAoJENxXPbmyJufq6RMQAJZMBrNlLxKL65hP/wktCVc3
fTaFgtE9SY+h9NNNoWDWgtOPHdiXixX0jJ8BONphuLXtYk53cmVuMgYqZaU9Cgfy
06m2X2S6Sn4RZ1K8ggqprHGWdexFbY2VB9g4w8q3k00BtSNMfTBjWjuP/OkMDH8R
MqPXxrloM3d4IJUExqWpM8T1i6T4B1GGGnuJV+5x77CgX6imruCdIOWhJsK4d3S2
D4qvifqibMP6bkznVdI9ny6yKmD4XQAGlvXXFYd83UByvmieNxTXo9r0vAd828jZ
BdFHiWgUjwqpalB2slDtQwIyY13AwDZ5mju9hSDCZNEdetfAudmuzZ6XU8vrh5Y1
2bMrpXD1kPtl06IusRytpON4NSJvDsLGbma6Hj5q8DpDjr85KmiPeQh3jL7XNyNU
lpE8XGLSxli3wolaVA32jWR2zRKe5NNRmyDfJIQRgXITLuhqNdMWa9PYmutGIZUn
Dfuv2ti67FRY61moqy3dvZmHiLVg/IVzhyBUnBwzLKlk6Fh0+cIAraHG4wpYST0l
I2YL04/3woiEZnI6QnOHJgkdXeqv8tyyHjmwLV6/ZqqunRtCjwhVAIwmFsNn32re
uJ1VmyrKfISWpd2uqVWFzCcqXpEzF6tIsmEuy643JFoGitNrA5eQGeeexi2D2IdW
zqhaoilbLEQNtviZ3Yx8
=MKmL
-----END PGP SIGNATURE-----
```

When I use `keybase sign -m "This is something. It should be signed."`, the result is something like this:

```
-----BEGIN PGP MESSAGE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org

owEBXQKi/ZANAwAKAdxXPbmyJufqAcstYgBTJuPYVGhpcyBpcyBzb21ldGhpbmcu
IEl0IHNob3VsZCBiZSBzaWduZWQuiQIcBAABCgAGBQJTJuPYAAoJENxXPbmyJufq
1yMP/jPHjv9w3XcOV+CUT8sHyxC9YE7lkOHXcMj65ptAZZ08JYtZQ1aSZCkkx3AF
2hSVZSRTjEI6wVSbbA4AQw2MFsNwKTpjJJ6Hsvm7GhqxvJ0qkB7BmXQpxmnrF7ap
bPnQkWtlN5HFEDQ3fKRP9DapPuSQnfzEiD3r37NTaQDkcpdoDzHYH+zjKoFqX1gY
yaLHW6CHXo9VBqK3xP+AEupsUYLHWqgihC2sibUaeDBuL4UZG84kqd+W3rqzyekr
AjKcBxG9z82VxsJTGKKPZIaI7OATbeuFVZimjepZO1YkTiOWLw7ICfifEmWJ0P7t
MtCmuMJuX0SSaBMXhfRh+5hCFD9pGFqAkmIU2xfBPy+YUvuvNLIvdtkwtgU4jadg
OaKaTKh0AxFH+r2w3sgmT2mQoknJRSQkKeGxedlhq8OYJq8misODOALqL/n5FaRa
goBRaC7wqlCPiOWSlfRSID0EI94bltO9kwvwzu/wz1xT48bjmuPDbXx+cmYfTzKe
kszc/z9A4lQeEWvzuzueSeko33YrSQHVVpxQ6tPzKIf2SHjlWW1ddrXT1cLG5jsU
Uk/TohxgbQiqBNZFer2dNBXnAVUTrpL8hISrWzAXvgFzhE7zwe+8ptixqNL11y29
6Pl1NgGAzouev6/Kh/jQW+erjZyxQjv3p4yHZkpy1rfUfnrp
=zzal
-----END PGP MESSAGE-----
```

The former can be copy/pasted into an email client, and recipients can view the contents immediately, and optionally verify.

The second seems to require that the recipient use a verify function before seeing the contents.

Why the difference? Are these commands supposed to be analogous? Can one be updated to match the other?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by comparing the output of `keybase sign -m` with the output from https://keybase.io/sign, focusing on the OpenPGP message types shown in the examples. Determine whether the CLI should produce a cleartext signed message that email clients can display, and verify the result with the relevant signing and verification commands.

Written by the indexing model from the issue text.

Assessment

Domain
cli, cryptography
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.