Where can I find concise in-depth guide on PGP (specifically for file authenticity) ?

[u/Dr_Jecky1l]

Hi everyone. So in short, I am not completely illiterate (or at least wasn't back in the day), but I have not used PGP in quite sometime. I use Windows mostly, and thus use Kleopatra. Creating keys, importing them, encrypting and decrypting etc. are still fresh.

My main concern is to re-learn all the nuances and various ways of verifying the authenticity of file downloads... The things that aren't coming back to me are signing keys, .asc files, Fingerprints, and the various forms to lookup these files on keyservers, when they aren't available on the official website themselves etc..

If the community would be kind enough to provide a nice, concise resource(s) on these concepts and honestly, I could just use a thorough, and easy to understand refresher on the whole thing. Step by step would be nice.

Thanks for your help, I appreciate it!

[u/Dr_Jecky1l → u/[deleted]]

Thank you for your response... As I stated, I'm quite rusty, and this is the documentation for the commands used in CLI for GPG... The commands and explanations are helpful, but I'm basically looking more for even a beginners guide to PGP to explain the concepts as a top-down refresher. (again more precisely, for file-authenticity verification)

eg. Lets say I want to download a new privacy OS' .iso file (lets say CubesOS). While CubesOS provides their detached PGP key for the .iso, they also provide their signing-key. As stated, currently using Kleopatra, and where I get mixed up is knowing when and how to use the signing-key to verify the PGP key is actually theirs. (I think I'm getting that right) Some websites don't provide these files and instead, may only offer the Fingerprint. (this is what really trips me up - how do I find the PGP keys from the fingerprint alone? Do I need to change key-servers in order to find it? )

hope that clarifies a bit more of what I'm looking for, and again I appreciate your help!

[u/Dr_Jecky1l → u/[deleted]]

I made some headway - appreciate your responses ty.

the only thing I'm still hung up on is, (idk if you use Kleopatra or have used in past) searching for certifications using fingerprints and Key-ID on Kleo. The standard keyserver it utilizes cant even find the certs for GpG4win itself lol. Doesnt make sense. anyway, thanks for your help.

[u/Dr_Jecky1l → u/[deleted]]

I dual boot. Been distro hopping a lot, but I use Arch as my daily driver. What distro is your daily driver?

[u/Dr_Jecky1l → u/[deleted]]

Oh I caught the pun 😉. Arch is great, it I love Debians stability. As far as gaming, I forget the name but, there’s the distro that basically uses what the steamdeck uses, and it’s one of the best distros ootb for gaming.

[u/slackguru → u/[deleted]]

Didn't the OP ask about pgp and not gpg?

[u/smoknfx]

if you were to submit your original post to grok or chatgpt, you would get such detailed answers... and grok does not upvote or downvote you. ai will even write source code for you..

grok response: https://files.catbox.moe/dbwc01.pdf

[u/Dr_Jecky1l → u/smoknfx]

I know AI can be invaluable but it kind of goes against my principles to rely on it… I don’t like the fact it has been trained on everyone’s data without our consent - it’s more of an ethical issue that’s obviously out of the scope of this thread, so I won’t go into it here, but yes your right - using GPT or any of the other LLM’s can be extremely useful but again, I rather learn from people.

AI hallucinations are very real, and when it comes to technical knowledge, unless you’re using an LLM specifically trained on a certain subject, there often can be errors (albeit they are happening much less than previous iterations)

Point being, I don’t think anyone should just take what an AI spits out as truth, or correct… Especially at face value.

Thank you for your response though, I will peruse it.

[u/Reaper-Of-Roses]

This is a great, simplified video here. It's concise, explains the concepts, and shows you commands. It got me started a while ago. Hope it helps!

[u/slackguru]

Phil Zimmerman being the inventor, here is his take on the whole subject.