keybase / keybase/keybase-issues

Use clearsign, non-detached signatures for manually verifying proofs

Open
#872 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I was somewhat confused with the documentation on pages like [username/sigs](https://keybase.io/justinbull/sigs/cSHzVkYYLa_naowrAElAXWDIcSDAdwnGHpna), as I was expecting an ASCII-armored, non-detached/inline signature of the JSON:

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

{
"body": {
"key": {
"fingerprint": "e09d38de8fb757452044a0f41a2bdeaa68fdb34c",
"host": "keybase.io",
"key_id": "1a2bdeaa68fdb34c",
"uid": "5b0948e12b399a335b656efac99d5000",
"username": "justinbull"
},
"service": {
"name": "twitter",
"username": "f3ndot"
},
"type": "web_service_binding",
"version": 1
},
"ctime": 1405522282,
"expire_in": 157680000,
"prev": "330b08127b708404eb6edcfe4f76408ede9662f485d28ca9b6290677eca04b71",
"seqno": 2,
"tag": "signature"
}
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)

iQIcBAEBCgAGBQJTx+6eAAoJEESFZfv8+htYOV4P/j6thn1TLIi8ntUEgXD8fpVA
TNjQtW2Q5G9vji6yC9/UHTq6/Ai6V90/OYBfy1opKmVwf7ydi8apc7aO9aG8rnXY
MKrmou8yg8CsHqRcjE99FMueQpJBxS8tRdLwirtiZLxTUx6mF+xhbFdVf0Aq+zwf
rF/mPLDIpG1v/isNK4LfXJYVITUJIve2nEBo5OAvwJI2cr/4D6tC5drJ7AK6hSzS
ClqPUb1pT5BzvV1ZIretm6oPYPngVB0g3q8yfQqeHITD3IWK/bPD4MpHXCcwyhR2
Wnev7HliMa3YY8WpCjgtjEO1+tKs1vW7lT9DrJxie4nX528ihBGq5YfjhcKxK0kq
+mVJBGXJsTtnGTZuJCwMvQeUEEhP6kAHRg7BfqEm6ZMYy5AOpqH/4qTF1hIQy2kC
Rpqa31B11uEQxXLbFCs2nEmmTDAbIrokNdhun3x4F09n3qH574kFkhPnznZ7Pofp
BbIDJ37eCZ2CPLkUi8KJErsyXaXI3K3eNPiB+eW2NhZWZqY7D69Vk+fTEnASz3g+
RdChep5Y49mhisKvo4CbkLYr96g/Du72bowA1Ei9J55r9v1fqzIqWCaItGZMjpGf
tn6Sor9aolobIpiONCFsu95NrazomBnAJQfG11mqz/bL2DKWPNC6kCKtUHvnCeRq
qXZBZznOz8BrOesOn9pI
=RMWs
-----END PGP SIGNATURE-----
```

This let's me just copy & paste the above blob into `gpg --verify` (which will wait for input from STDIN) and press Ctrl+D to end input:

```
gpg: Signature made Thu 17 Jul 08:41:18 2014 PDT using RSA key ID FCFA1B58
gpg: Good signature from "Justin Bull (Supersedes all keys prior to 2013) "
gpg: aka "[jpeg image of size 1915]"
gpg: aka "Justin Bull "
```

Instead, with the big blob when I use `gpg --verify`, all I get is the _Good signature_ response but not indication of what was signed. I had no idea that `gpg -` (pasting to stdin, Ctrl+D) would magically reveal the JSON in addition to verify the signature (thanks #658).

So I advocate that keybase.io has inline PGP clearsigning of proofs for manual verification.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the linked username/sigs proof page and reproduce the current behavior using gpg --verify with pasted input. Compare the detached proof output with the requested clearsigned format; done means a manually copied proof both verifies and exposes the signed JSON through standard GPG input.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.