On 21/02/18 11:53, Peter Lebbing wrote: > The > author might not be available anymore or willing to expend any effort.
(Or the author might not have a more authentic copy of the file anymore either. This is not the reason I'm self-replying though). > This all comes with a major caveat. Make that two. The OP writes: On 21/02/18 10:37, Henry wrote: > I downloaded a tarball ***6.4.tar.gz, it's signature file > ***6.4.tar.gz.sig, and the author's public key ******.pgp from a > well-known site. This sounds like there is no more assurance that the downloaded key is authentic than that the downloaded file is authentic. When to decide that a key is authentic is one of the more difficult problems of practical cryptography use. Some people take confidence from downloading identical copies of the key from multiple HTTPS websites. There are still ways for an attacker to serve you the wrong one each time, but it's better than nothing... The best is direct personal contact with the owner of the key, but it seems a long shot. HTH, Peter. -- I use the GNU Privacy Guard (GnuPG) in combination with Enigmail. You can send me encrypted mail if you want some privacy. My key is available at <http://digitalbrains.com/2012/openpgp-key-peter>
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users