-3

gpg has an option --armor, which can generate output in an ASCII-armored format similar to uuencoded documents.

It also has an option --clearsign which causes the document to be wrapped in an ASCII-armored signature.

How are they different? Can one be done alternatively in terms of the other? Thanks.


$ cat sleep.py
#! /usr/bin/python3
import time
time.sleep( 30 )

$ gpg --clearsign sleep.py  

$ cat sleep.py.asc
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

#! /usr/bin/python3
import time
time.sleep( 30 )
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEgp775lYsDVGRz/4m1bmNWQ9vUP4FAlxYfZQACgkQ1bmNWQ9v
UP7BTgv/QphBjsW+7i4rq/o5KcooEvd4g7dWClulqvBAE55P6FaezbSQBvP+nnjb
aHiTwWPq4qQLfV3rcaxOrH95hZHiloLIaZoY4f3kVBHD6tcWpJSnyJ2cih+I3HL/
vJyVM9KCakLrtNTX/wDDGiKLg0MQk3g77SllAsmt1A/gRX+PySUHOd212NRYN/Ht
OCxe53lI9xyYT+qRiySIGHzKMCC6l0Kg0lO0qS3wB9eKWNajfmP3KvRqHN0Wraex
8fd7DjLdlPXhkBFypNfo0h8RbMUkr2+Kltb7ZUMVoJtLjH+WOacHdqX9H7FY29lA
A4aqwneriMrSlAFL2WusOJ5R9VRunbMQJRaG5tkR6YR6ZMv2diA2f/j5muXSw8+m
Vh9t0NEXPyP5eMr5xrtB3n06ciXl++vYD+p6e3Bq7QNehfZuanZMYrCSafUoLTVe
ubUTa6gUjPEw6A/wwBZwZuZC27Ivy6Skt4Iw1hfvx2eyJxhDAANaATqSZTO18zEF
nJ7H1FHU
=g9wE
-----END PGP SIGNATURE-----


$ gpg --armor --detach-sign sleep.py
$ cat sleep.py.asc3
-----BEGIN PGP SIGNATURE-----

iQGzBAABCgAdFiEEgp775lYsDVGRz/4m1bmNWQ9vUP4FAlxYfh4ACgkQ1bmNWQ9v
UP6UZQv+PrfkPbQWB4XnbDmpiWDZJC4Z6ZFf1q44uhbcT4QzeKET8VFe27ipJRXV
QR+rTOyuVpo+qE/xDBkD+SVM3sYPwZ01yaYt6CGK6YKWYacJUuZpLXnLY8R5ycTY
3EmjpJ8nt3JcWMGH3DtwEHSpvVzgVAfyIFQiHpsXJgXhqdrzR0/4eNkkf9TSzRSA
KcRQYjkmBYCfq+h6l2fuUx5lmungY5zqVR2ZKvfMYNryTmBZXMzQOHPrlNzTggXm
STcQLDqJdPJ7/3SQDQhEyi7xbl3uPdYitxKy0krS3kl25b6Zmg/RBelXRFnuVS+b
3JfNrrabhv8uN8wV62LK6Coq7Gv1eIDhtW7sZ7pHFnG9h8Q37AJZuTK3iOctfD4e
5QlBCHUbgQUbkfYLmyKQdgCCH3OSL0RtqhWXuqBP4GYSxmRp8af2XNrl/+o/gOQP
ctCSD9bWtoA74li6VzU1p3YI9Q6ilc1+GBqGL3isE39jf1hL4dtMu/iWExWgytPk
6Im1ZqrO
=TyOB
-----END PGP SIGNATURE-----
4

--armor is an output modifier: you use it in addition to other arguments which specify the operation you want gpg to perform, and it changes the output to be an ASCII-armored file instead of a binary file. Thus

gpg --armor --sign myfile

will sign myfile and output the signed file in myfile.asc, but none of the contents of myfile will be immediately visible in myfile.asc. (gpg compresses the contents by default, among other transformations.)

--clearsign is a complete operation: gpg signs the given file, and wraps the signature around the content without modifying it. Thus

gpg --clearsign myfile

will sign myfile and output the signed file in myfile.asc, in such a way that the original contents of myfile will be immediately visible in myfile.asc.

Clear-signing is ideal for signing emails or other text documents which should remain readable as-is, without involving gpg. Recipients can optionally verify the signature using gpg, but they don’t have to use gpg to read the contents.

You can approximate the result of --clearsign using --armor by producing a detached signature (gpg --armor --detach-sign myfile): if gpg doesn’t need to alter the signed content, then the detached signature will be identical to the signature block at the end of a clear-signed file. You’d need to add the appropriate header:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

or whatever is appropriate.

  • Thanks. " it changes the output to be an ASCII-armored file instead of a binary file". What is relation between an ASCII-armored file and a binary file? – Tim Feb 4 at 17:27
  • Found it. en.wikipedia.org/wiki/Binary-to-text_encoding – Tim Feb 4 at 17:42
  • Why are gpg --armor --detach-sign myfile and the signature in gpg --clearsign myfile still different? – Tim Feb 4 at 18:03
  • The native OpenPGP format uses arbitrary octets. ASCII-armored files represent this data by encoding it using Base64, along with a checksum and header lines describing the data. See RFC 4880, section 6.2 for details. – Stephen Kitt Feb 4 at 18:04
  • They’re different because their contents aren’t the same. A detached signature contains only the signature, a clear-signed file contains the signed data along with the signature. – Stephen Kitt Feb 4 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.