How does pgp signatures work?
In: 2
You run your message through an algorithm which produces a fixed length hash. The hash is then signed with your private key.
The nature of asymmetric encryption is that whatever is encrypted with one key can only be decrypted with the other. So whatever is encrypted with your private key can only be decrypted with your public key.
If they get the message, produce the hash, then decrypt your signature with your public key, then your unencrypted hash should match the one they generated themselves. If it doesn’t, then that means:
The message was corrupted or modified in transit, resulting in them getting the wrong hash; or the hash wasn’t encrypted with your private key because they were unable to correctly decrypt it with your public key.
Latest Answers