all right.
so for this video, we're going to talk about signing messages and verifying signatures on messages.
so this is a really important part of pgp because anyone can just send you in a pgp encrypted text, but it's important to validate that the person you expect to send it is actually the one sending it.
so if you've imported someone keys before because you can trust them or you've got it from a valid source, you can now you can now also verify signatures related to that.
and you can sign stuff yourself.
if you have a pgp key and you want to sign something to prove that you are the one who sent it.
a signature essentially just means that you are in control of the private key.
you can't sign without that private key.
so someone can validate that, okay, if they signed it, they are in control of those keys, meaning i should be able to trust the source of that pgp signee and the pgp encrypted message.
so let's hop back over to tails to see a few examples of this in action.
now here on tails, we got a few different messages, but the important one i wanted to see is this one right here.
it says this message is signed by me.
so that's the actual message in plain text.
but there's a pgp signature also at the end of this.
so we want to actually validate this pgp signature to ensure that the pgp signed message is correct.
so what we'll do is back in cleopatra in our notepad, we can throw it in here.
and then we can select decrypt verify notepad.
and you can see right here because it was signed, there's a valid signature by me at freeboot dot com.
signature was created with this certificate.
now if i was to grab that text again, and if i was to paste it in here and change something about it, say change signed by me, i swear.
instead, if we decrypt and verify, you'll see that nope, it doesn't work.
so the signature validates that message above.
so what the signature is validating is that this message is what i'm sending.
right here, the message was this was sent by me.
so what vendors do on the dark web and what websites do is they might assign something that have some urls of their site so that you know that those are the valid urls that they are sending.
because if that url is changed by even one character, it will no longer work.
for example, if this part of the message was a dot onion url and it was changed by one character, even an extra space, and you go to decrypt and verify it, you'll see that it's a bad signature.
it comes up red.
so that is all that is required to actually verify signed messages.
it's pretty simple and it's a good way to be sure you're actually communicating with who you expect.
and if you wanted to sign your own message, it's actually not too difficult.
all you would need to do is say whatever your message is.
i am signing this message for those out there, my signing code is 121 2121, right?
that's my signing code.
so what i can do is in recipients, i can just select sign and we're not going to encrypt it for other people.
we're just going to in general sign a message.
now you can sign an encrypted message as well.
but in this case, we just want to send it out.
and we can just sign the notepad.
and boom, we have a very similar message here.
and if i was to decrypt or verify, if i change just one character, say added another one and decrypt or verify, you can see now it's a bad signature.
so that's really all it takes is for actual signing.
now, if you were to sign a message for somebody, you can also do that by just doing what we've done before, right?
encrypt it for others, but also sign it as you.
so this way they can actually validate the message by decrypting it for them.
and they can validate that you signed the message and that you have control of that public and private key based on the key that they have imported.
so that's really it.
if you have any questions on this process, of course, let me know.
otherwise, we'll see you in the next one.