keybase / keybase/keybase-issues
Use clearsign, non-detached signatures for manually verifying proofs
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
I was somewhat confused with the documentation on pages like [username/sigs](https://keybase.io/justinbull/sigs/cSHzVkYYLa_naowrAElAXWDIcSDAdwnGHpna), as I was expecting an ASCII-armored, non-detached/inline signature of the JSON:
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
{
"body": {
"key": {
"fingerprint": "e09d38de8fb757452044a0f41a2bdeaa68fdb34c",
"host": "keybase.io",
"key_id": "1a2bdeaa68fdb34c",
"uid": "5b0948e12b399a335b656efac99d5000",
"username": "justinbull"
},
"service": {
"name": "twitter",
"username": "f3ndot"
},
"type": "web_service_binding",
"version": 1
},
"ctime": 1405522282,
"expire_in": 157680000,
"prev": "330b08127b708404eb6edcfe4f76408ede9662f485d28ca9b6290677eca04b71",
"seqno": 2,
"tag": "signature"
}
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
iQIcBAEBCgAGBQJTx+6eAAoJEESFZfv8+htYOV4P/j6thn1TLIi8ntUEgXD8fpVA
TNjQtW2Q5G9vji6yC9/UHTq6/Ai6V90/OYBfy1opKmVwf7ydi8apc7aO9aG8rnXY
MKrmou8yg8CsHqRcjE99FMueQpJBxS8tRdLwirtiZLxTUx6mF+xhbFdVf0Aq+zwf
rF/mPLDIpG1v/isNK4LfXJYVITUJIve2nEBo5OAvwJI2cr/4D6tC5drJ7AK6hSzS
ClqPUb1pT5BzvV1ZIretm6oPYPngVB0g3q8yfQqeHITD3IWK/bPD4MpHXCcwyhR2
Wnev7HliMa3YY8WpCjgtjEO1+tKs1vW7lT9DrJxie4nX528ihBGq5YfjhcKxK0kq
+mVJBGXJsTtnGTZuJCwMvQeUEEhP6kAHRg7BfqEm6ZMYy5AOpqH/4qTF1hIQy2kC
Rpqa31B11uEQxXLbFCs2nEmmTDAbIrokNdhun3x4F09n3qH574kFkhPnznZ7Pofp
BbIDJ37eCZ2CPLkUi8KJErsyXaXI3K3eNPiB+eW2NhZWZqY7D69Vk+fTEnASz3g+
RdChep5Y49mhisKvo4CbkLYr96g/Du72bowA1Ei9J55r9v1fqzIqWCaItGZMjpGf
tn6Sor9aolobIpiONCFsu95NrazomBnAJQfG11mqz/bL2DKWPNC6kCKtUHvnCeRq
qXZBZznOz8BrOesOn9pI
=RMWs
-----END PGP SIGNATURE-----
```
This let's me just copy & paste the above blob into `gpg --verify` (which will wait for input from STDIN) and press Ctrl+D to end input:
```
gpg: Signature made Thu 17 Jul 08:41:18 2014 PDT using RSA key ID FCFA1B58
gpg: Good signature from "Justin Bull (Supersedes all keys prior to 2013) "
gpg: aka "[jpeg image of size 1915]"
gpg: aka "Justin Bull "
```
Instead, with the big blob when I use `gpg --verify`, all I get is the _Good signature_ response but not indication of what was signed. I had no idea that `gpg -` (pasting to stdin, Ctrl+D) would magically reveal the JSON in addition to verify the signature (thanks #658).
So I advocate that keybase.io has inline PGP clearsigning of proofs for manual verification.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the linked username/sigs proof page and reproduce the current behavior using gpg --verify with pasted input. Compare the detached proof output with the requested clearsigned format; done means a manually copied proof both verifies and exposes the signed JSON through standard GPG input.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100