This documentation contains instructions on how to sign files via, and verify files signed via,
OpenSSH
keys.
Unlike PGP,
OpenSSH uses only modern, sane cryptography, and OpenSSH keys, key management, and signatures are simple,
using mainly plaintext files. OpenSSH also
supports revocation,
akin to PGP.
Within this documentation, # is used to denote running the command as the root user, and
$ is used to denote running the command as an unprivileged user. The lowest-privileged user
able to run the commands will be used for each command. Some shells may present different characters for
privileged and unprivileged users than used in this documentation; the shell's documentation should be
consulted if this is true for the system being used.
The complete OpenSSH-signing-and-verification documentation can be consulted via either the manpage via
man ssh-keygen, or
OpenBSD's online ssh-keygen documentation.
In order to sign a file via OpenSSH, an OpenSSH private-key must be used. If an OpenSSH key-pair
is not yet possessed, the following command can be used to generate a key-pair:
$ ssh-keygen
It is recommended that the Ed25519 algorithm be used, rather than the legacy RSA or ECDSA
algorithms. To force generation of an Ed25519 key-pair, -t ed25519 can be suffixed to
the above command. If a FIDO authenticator to be is used along with the private-key,
-t ed25519-sk can be suffixed to the above command, instead.
The following command can be used to sign arbitrary files:
Upon running the above command, a signature-file will be created and stored alongside the file
which was signed, with .sig as the filename extension. The signature-file is used to
verify the signed file. Both the signed file and signature-file must be present to perform
verification.
-Y check-novalidate should not be used for checking for
malicious tampering, as no signer identity-check is performed. It is useful for checking
for non-malicious corruption, only, for files obtained via a trusted source, such as a
home or office Local Area Network.
