Signatures and Hashes - ligos/readablepassphrasegenerator GitHub Wiki

Signatures and Hashes

From version 1.0.0, all releases (ZIP, PLGX and NUPKG files) have hashes, PGP and KeyBase signatures to verify their authenticity. The PGP public keys are listed below.

All versions (from 0.1 onwards) are signed with a .NET Strong Name, which can be used to verify the DDLs and EXEs (but not the ZIP and PLGX files). The public key is located in Github, and below.

Caveats

Note that the Strong Name key provides some evidence that the DLL / EXE has not been tampered with, it is entirely possible to circumvent and doesn't stop the plugin from being loaded by the .NET runtime. The KeePass Plugin is signed with a Strong Name, NuGet packages for .NET Standard are not.

Note that GitHub uses HTTPS for all connections (including uploading and downloading releases). Thus the hashes do not provide any real authenticity. That is, the files are highly unlikely to be tampered with during download (because of HTTPS). They are much more likely to be tampered with due to my GitHub account being hacked, or GitHub themselves changing the file on their server. And in either of those cases any bad guy who posts a malicious ZIP or PLGX file can just as easily post the correct hash.

If you really want to verify your downloads, use the PGP or KeyBase signatures.

I have mirrored the PGP public keys and all signatures on id.ligos.net, and on my GitHub profile. As of version 1.1.1 (released 2018-04-21), the below PGP keys are part of my KeyBase public profile. My KeyBase profile is https://keybase.io/ligos. (Note that the signing keys for PGP & KeyBase are different). (Note that KeyBase has discontinued their public filesystem; signatures are available on id.ligos.net).

If you want further evidence of my sole ownership of the PGP key pair, you'll need to find someone who can verify it personally and attest as such in Sydney, Australia.

PGP Public Key (Github, effective from October 2019, V1.2.0)

User-ID: Murray Grant (Github) [email protected]

Validity: from 2019-10-16 until forever

Certificate type: 3,072-bit RSA (secret key available)

Certificate usage: Signing EMails and Files, Encrypting EMails and Files, Certifying other Certificates

Key-ID: 8508 90F4 15AE 49CE

Fingerprint: 13D7 2C26 A635 5365 8673 BE8D 8508 90F4 15AE 49CE

PGP Public Key (from BitBucket days, V1.1.2 and earlier)

User-ID: Murray Grant (BitBucket Code Signing) [email protected]

Validity: from 2017-05-08 until forever

Certificate type: 2,048-bit RSA (secret key available)

Certificate usage: Signing EMails and Files, Encrypting EMails and Files, Certifying other Certificates

Key-ID: 9321 9E8E 622E DAF0

Fingerprint: 1812 7884 6ED1 2B2D 4B8B D773 9321 9E8E 622E DAF0

.NET Strong Name Public Key

C:\Users\msn\Documents\programming\dot net>sn -tp MurrayGrant.public.snk

Microsoft (R) .NET Framework Strong Name Utility  Version 4.0.30319.0
Copyright (c) Microsoft Corporation.  All rights reserved.

Public key (hash algorithm: sha1):
002400000480000094000000060200000024000052534131000400000100010019de0ad9da8e43
99f52daf2410b78a1e3fd4a9c290276bdbdddd8d1f7ab062d581af75b535d85c03c59805b10c11
633c7388d63ea1bf2d450db926a2024a31e910bf129feb243c429b40532e377ae580cf1115f94d
6dc7e4c811ce3175a9d06b1be3a7e0c54d00ef329e21901288b7e2bb616aa7d63dfe687261f012
7f021cda

Public key token is aacd6bbb302d670a

How to Verify Using GPG

Import the public PGP block, from above, into your GPG key store.
Download the zip / plgx and associated signature txt files.
Remove everything from the signature txt file except the PGP signature block.
Rename the text file to .asc, if it makes you feel better.
Run gpg --verify <signature file> <zip or plgx file>

Example:

PS C:\Users\msn\Downloads> cat '.\PassphraseGenerator Console 1.0.0.zip.txt'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAABCAAGBQJZEFokAAoJEJMhno5iLtrwk5YH/RjttHIidfsDQZFn7u4rkqyv
JyuWzGLkjHm7P9LSG0EhTniqZecZvBrVQmBbuMEcd74Si+MARBdEG+sHq/cLAEPV
vKAnG9Ji179lDfB8mrylin0RHR/3uQLQxP9ms4g7Wf4ayp73TuQ85GP5+ILI7PQk
iinvof2PKguyD9/Yx13yNSTqeD0gY2fA1rEjgr0hLWZusoFZdD6A4AAWNpIvQtMO
BCYvqaNiMe/Kl5qvrsrJFiKwWdXXwPSsMtfZncLx4OjD9odfdalKG+a4V1jtUORG
iZrMfiOBu0Stiy27XgNTxac4+8mdSmuagEbJ6dehuCjHVTnmgTxnGaFvsf/k/SQ=
=Hhz0
-----END PGP SIGNATURE-----
PS C:\Users\msn\Downloads> gpg --verify '.\PassphraseGenerator Console 1.0.0.zip.txt' '.\PassphraseGenerator Console 1.0.0.zip'
gpg: Signature made 05/08/17 21:44:36 AUS Eastern Standard Time
gpg:                using RSA key 93219E8E622EDAF0
gpg: Good signature from "Murray Grant (BitBucket Code Signing) <[email protected]>" [ultimate]
PS C:\Users\msn\Downloads>


PS C:\Users\msn\Downloads> cat '.\ReadablePassphrase 1.0.0.plgx.txt'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAABCAAGBQJZEFqWAAoJEJMhno5iLtrw9sQH/3xAgMMW3y6z61+neI/UoF00
osv/T0gf9D7CK0xvggmknsrr9te4ZJVQXU+e2VjZSh8gTt0U51yxkWElsijzpuqJ
0hCoyWLiuT5gWL/E9dD9sLRMlAeY9n3jNeF9abCnnfR41RIBxCTqCmlni4sq0NM1
s4QRvf/K0UJm9xzt+0t13Amn1b/Thzb8PQGBSfEA8sPqaaUE8VlXPucjmNX/fgkX
O4eaTJqmVIot4cnHJYzxys72x4w0YYwClDcPhmFh0nSZxi5lUDJWOEMNnDlKmRXA
kYYe9uDGxmC7se44AYk7FoAl/lNqQ1d64lXoGj3U1zxesFikYmMaDsHzWLssRTI=
=RLtW
-----END PGP SIGNATURE-----
PS C:\Users\msn\Downloads> gpg --verify '.\ReadablePassphrase 1.0.0.plgx.txt' '.\ReadablePassphrase 1.0.0.plgx'
gpg: Signature made 05/08/17 21:46:30 AUS Eastern Standard Time
gpg:                using RSA key 93219E8E622EDAF0
gpg: Good signature from "Murray Grant (BitBucket Code Signing) <[email protected]>" [ultimate]
PS C:\Users\msn\Downloads>

How to Verify Using KeyBase

Download the zip / plgx and associated signature txt files.
Remove everything from the signature txt file except the single line starting with BEGIN KEYBASE SALTPACK DETACHED SIGNATURE.
Rename the text file to .asc, if it makes you feel better.
Run keybase verify -d <signature file> -i <zip or plgx file>

Example:

PS C:\Users\msn\Downloads> cat '.\ReadablePassphrase 1.1.1.plgx.keybase.asc'
BEGIN KEYBASE SALTPACK DETACHED SIGNATURE. kXR7VktZdyH7rvq v5weRa8moLXtsPx 1HB5gQmN1wVxZgq P8w5myeex0QH59F sxVTEupRMAbKyzu E31Jvb5rnhd0ujW houueotpNaURv6M tDssk8aoe5fwd4m VwUBeq8q4bNRbfQ 8n3iqL2Xq2VEVa5 cRCtrEgv7aLnb4o NoPKat60ZYMsFmC q. END KEYBASE SALTPACK DETACHED SIGNATURE.
PS C:\Users\msn\Downloads> keybase verify -d '.\ReadablePassphrase 1.1.1.plgx.keybase.asc' -i '.\ReadablePassphrase 1.1.
1.plgx'
Signature verified. Signed by ligos (you).
PS C:\Users\msn\Downloads>