A PGP signature is a cryptographic proof that confirms the authenticity and integrity of a message or file, ensuring it was sent by the claimed sender and hasn't been altered. It uses public key cryptography to bind a sender's identity to content through a unique digital fingerprint.
PGP signatures rely on asymmetric encryption: the sender signs data with their private key, and anyone with the corresponding public key can verify the signature. This process prevents impersonation and detects modifications. For example, when you download software from a developer's website, a PGP signature lets you confirm the file hasn't been replaced with malware during transit.
The OpenPGP standard, defined by RFC 4880, governs how PGP signatures are generated and validated. Tools like GnuPG (GPG) implement this standard. A valid signature proves both origin and unaltered state-critical for secure email, software distribution, and document verification.
When a user creates a PGP signature, they first generate a hash-a fixed-size digest-of the original message or file using a cryptographic hash function like SHA-256. This hash represents the entire content in a compact form. The sender then encrypts this hash with their private key. The resulting encrypted hash is the signature.
Verification happens when the recipient receives the message and signature. They compute the same hash from the received content and decrypt the signature using the sender's public key. If the decrypted hash matches the computed hash, the signature is valid. Any change to the message-even a single character-will cause the hashes to differ, breaking the match.
This mechanism ensures two guarantees: authenticity (the message came from the person who claims to have sent it) and integrity (the message hasn't been modified). Without a valid signature, a message could be forged or altered without detection.
PGP supports multiple signature formats based on the signing algorithm and key type. The most common are:
| Signature Type | Algorithm | Use Case | Security Level |
|---|---|---|---|
| Detached Signature | DSA, RSA, EdDSA | File verification (e.g., .asc files) | High (SHA-256+) |
| Inline Signature | RSA, ECDSA | Encrypted emails with embedded signature | Medium-High |
| Clearsigned Text | Any supported algorithm | Readable messages with embedded signature | Medium |
Detached signatures are commonly used for software downloads. The file and signature are separate, allowing users to verify the file without altering it. Clearsigned text embeds the signature within readable text, useful for signed emails or documents where the content remains human-readable.
One non-obvious distinction: a PGP signature does not encrypt the message. It only verifies authenticity and integrity. Encryption and signing are separate operations. You can sign a message without encrypting it, or encrypt it without signing-though combining both offers the strongest security.
Many assume a PGP signature provides confidentiality. That's incorrect. A signature only confirms origin and content integrity. To protect privacy, you must separately encrypt the message using the recipient's public key.
Another confusion arises between PGP signatures and SSL/TLS certificates. While both involve public key infrastructure, they serve different purposes. SSL/TLS certificates authenticate websites during HTTPS connections, while PGP signatures authenticate individuals or files in peer-to-peer communication. PGP operates independently of centralized certificate authorities.
Some users think a valid signature means the content is trustworthy. That's not guaranteed. A signature only confirms the sender's identity and content integrity. It doesn't validate the content's truthfulness or safety. A malicious sender can still sign harmful code-so trust must be established separately via key verification or reputation systems.
Consider downloading Ubuntu 24.04 LTS from the official site. The ISO file is large-over 2 GB-and vulnerable to tampering. The developers publish a PGP signature (.asc file) alongside the ISO.
To verify it, you run:
gpg --verify ubuntu-24.04-live-server-amd64.iso.asc ubuntu-24.04-live-server-amd64.isoIf the output includes "Good signature from 'Ubuntu CD Image Automatic Signing Key'," the file is authentic and unmodified. The signature was created using the official key, which you've previously verified via the Ubuntu website or key servers.
Without this step, you risk installing a compromised system. Malware distributors often replace legitimate software with trojanized versions. A PGP signature prevents such attacks.
I once released a command-line tool for system administrators. After building the binary, I signed it with my PGP key using gpg --detach-sign --armor release-v1.2.tar.gz. The output was a text file containing the signature.
I uploaded both the binary and the signature to GitHub. When a user downloaded the file, they ran:
gpg --verify release-v1.2.tar.gz.asc release-v1.2.tar.gzOnly those who had imported my public key could verify the signature. I included instructions to fetch my key from a keyserver: gpg --keyserver hkps://keys.openpgp.org --recv-keys 0xABCDEF1234567890.
One user reported a failed verification. I discovered they'd used a mirror site that hosted a corrupted version. The signature failed because the hash didn't match-proof that the signature caught a problem early.
A PGP signature is not encryption-it's authentication. It confirms who sent a message and whether it was changed. It relies on private keys for creation and public keys for verification. Valid signatures prevent man-in-the-middle attacks and ensure trust in digital exchanges.
Always verify signatures before executing software or accepting sensitive data. Use trusted key sources and cross-check fingerprints. The process adds minimal overhead but provides substantial protection.