Verifying the PGP Signature to electrum?

[Thomas29]

I haven't verified a PGP signature in a long time so I guess I'm doing something wrong. But I was hoping I can get a fresh view on how I can go about it or is the official walkthrough the best and easiest way to go about and I should just re-read and attempt it over again to figure out what I did wrong?

[1714690617]

1714690617

[1714690617]

1714690617

[1714690617]

1714690617

[1714690617]

1714690617

[1714690617]

1714690617

[Marvelman]

I'm not sure, but I don't think you can verify PGP signatures with Electrum. You'll need software like GnuPG or VeraCrypt to do this.

The process is relatively simple:

1. You download the public key (.asc file) of the software author.
2. Check the public key’s fingerprint to ensure that it’s the correct key.
3. Import the correct public key to your GPG public keyring.
4. Download the PGP signature file (.sig) of the software.
5. Use public key to verify PGP signature. If the signature is correct, then the software wasn’t tampered with.

https://www.linuxbabe.com/security/verify-pgp-signature-software-downloads-linux

[Charles-Tim]

Go though this guide:

[GUIDE] How to Safely Download and Verify Electrum [Guide]

Or this:

In order to be able to verify GPG signatures, you need to import the public key of the signer. Electrum binaries are signed with ThomasV's public key. On Linux, you can import that key using the following command: gpg --import ThomasV.asc. Here are tutorials for Windows and macOS. When you import a key, you should check its fingerprint using independent sources, such as here, or use the Web of Trust.

[Thomas29]

Okay it says I need to make my own PGP public key but doesn't explain how exactly so maybe I did that wrong idk? Out of curiosity of I use a hardware wallet like ledger nano s via electrum desktop app that is has not had PGP verification and worse case scenario no one can technically access my bitcoin that's on my hardware wallet. It'd simply be the pain in the ass of removing the software that's corrupted on the computer it was used on if I'm not mistaken?

[khaled0111]

Okay it says I need to make my own PGP public key but doesn't explain how exactly so maybe I did that wrong idk?

Which one of the above mentioned tutorials did you follow and what error message are you getting so we can help you? Creating your own key-pair isn't supposed to be that hard but it depends on the tool you are using.

Out of curiosity of I use a hardware wallet like ledger nano s via electrum desktop app that is has not had PGP verification and worse case scenario no one can technically access my bitcoin that's on my hardware wallet. It'd simply be the pain in the ass of removing the software that's corrupted on the computer it was used on if I'm not mistaken?

Technically, even if you download a fake copy of Electrum it won't be able to steal your coins from your hardware wallet without your permission. It doesn't have access to your wallet's private keys to sign transactions.

[Husna QA]

I haven't verified a PGP signature in a long time so I guess I'm doing something wrong. But I was hoping I can get a fresh view on how I can go about it or is the official walkthrough the best and easiest way to go about and I should just re-read and attempt it over again to figure out what I did wrong?

What OS did you use to install Electrum?

Make sure you download it from the official site: https://electrum.org/#download; https://download.electrum.org
and also check whether the PGP signature matches the public key or fingerprint of one of the developers, for example, ThomasV:
https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6

Below is an example of verifying a PGP signature from an Electrum wallet using Windows OS:

- Download Primary key fingerprint ThomasV.
- Go to the directory where the Electrum and signature files have been downloaded
- Verification

The following is an example of a screenshot:

For MacOS, there are only slight differences; you can see the following example:

[nc50lc]

Out of curiosity of I use a hardware wallet like ledger nano s via electrum desktop app that is has not had PGP verification and worse case scenario no one can technically access my bitcoin that's on my hardware wallet.
It'd simply be the pain in the ass of removing the software that's corrupted on the computer it was used on if I'm not mistaken?

Yes, by design, your private keys are contained in your Ledger Nano S.
The created Electrum wallet with it only contains its "extended public key" which can only derive public keys to addresses.
Worst case, your privacy is at risk, not that using an SPV wallet like Eletrum is private in the first place.

However, an unverified fake Electrum app may trick you to send to a different address or anything that'll change the transaction's data before you sign it with your hardware wallet.
That's still dangerous if you do not pay attention during verification of the address and amount shown in your Ledger's screen.

So try to verify Electrum even if you find it hard to accomplish.
If you came across any errors, report it here so we can tell you what went wrong during the process.

[Husires]

Okay it says I need to make my own PGP public key but doesn't explain how exactly so maybe I did that wrong idk? Out of curiosity of I use a hardware wallet like ledger nano s via electrum desktop app that is has not had PGP verification and worse case scenario no one can technically access my bitcoin that's on my hardware wallet. It'd simply be the pain in the ass of removing the software that's corrupted on the computer it was used on if I'm not mistaken?

electrum PGP Signature verification ensures that you have not downloaded electrum from an unknown source, which is often a scam, which means that once you install the application, connect the hardware wallet and click on the message signature button, they may be able to access all of your coins, modify the balance before signing, and show false data.
as we can know how this scam app works, but it will inevitably lead to you losing all or part of your balance, so try to verify the signature to ensure that you have downloaded the correct electrum.

[khaled0111]

electrum PGP Signature verification ensures that you have not downloaded electrum from an unknown source, which is often a scam, which means that once you install the application, connect the hardware wallet and click on the message signature button, they may be able to access all of your coins, modify the balance before signing, and show false data.
as we can know how this scam app works, but it will inevitably lead to you losing all or part of your balance, so try to verify the signature to ensure that you have downloaded the correct electrum.

You are correct. PGP signature ensure the authenticity of a file or a message. If I send you a signed message, you can verify it to be sure it was me who sent it.
However, even if you download a fake app and connect your hw device to it, It won't be able to access your coins. It can change some data like the recipient address and the sent amount but it still need your confirmation to sign the transaction. All the information will be displayed on your hw device screen before you click on the confirmation button to sign the transaction and approve it.

[Stalker22]

~
It'd simply be the pain in the ass of removing the software that's corrupted on the computer it was used on if I'm not mistaken?

Yeah, removing corrupted programs is a pain, but it is nothing compared to the nightmare of losing all your coins for good.  If that messed up software wiped out your wallet, leaving you with zero balance - now that would really suck! Thats like the worst case scenario when it comes to crypto fails.  Utter agony.  So while removing crappy corrupted stuff is annoying, be grateful it is not as bad as it could be.

[Thomas29]

I'm new to cryptocurrency in general but...

I downloaded the signature file next to the electrum download which I'm not sure about that if those are the right files in right order. I made a keypair but it mentions a private key?  Do I download the electrum file before or after verifying the PGP signature or do I only download the file next to it that says "signature" on the oiffical website?
 
"If you already have a private key that can be used to certify other people's keys, you can import it at this time."




I've needed to learn PGP encryption for anything in my life until now so any help is greatly appreciated more than one can realize lol.

[nc50lc]

I downloaded the signature file next to the electrum download which I'm not sure about that if those are the right files in right order. I made a keypair but it mentions a private key?

The guide is pointing to your GPG/PGP private key, it's basically the "secret" part of the keypair that you've created which consists of a private and public key.
It has no relation to Bitcoin's private key.
Since you now have a keypair, you can now proceed to import Electrum developers' public keys.

If the provided tutorials are overwhelming, try this simple one: bitcoinelectrum.com/how-to-verify-your-electrum-download/

[Thomas29]

I downloaded the signature file next to the electrum download which I'm not sure about that if those are the right files in right order. I made a keypair but it mentions a private key?

The guide is pointing to your GPG/PGP private key, it's basically the "secret" part of the keypair that you've created which consists of a private and public key.
It has no relation to Bitcoin's private key.
Since you now have a keypair, you can now proceed to import Electrum developers' public keys.

If the provided tutorials are overwhelming, try this simple one: bitcoinelectrum.com/how-to-verify-your-electrum-download/

To honest in a blunt way. It's only overwhelming it's confusing AF. It seems like the instructions are not in order I guess?

[hugeblack]

To honest in a blunt way. It's only overwhelming it's confusing AF. It seems like the instructions are not in order I guess?

What operating system are you using?
For Windows, this explanation is brief ---> https://www.youtube.com/watch?v=TzOHLL_dKCM
For Linux there is one code you can use which is explained  ---> https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Follow the instructions and take a screenshot if nothing works (make sure to hide sensitive information)

[nc50lc]

To honest in a blunt way. It's only overwhelming it's confusing AF. It seems like the instructions are not in order I guess?

You mean this guide: [GUIDE] How to Safely Download and Verify Electrum [Guide]?
It's on the correct order but it has instructions for three different operating systems, one introductory introductions, then the complete procedure per OS.
So if you scroll-down too much without reading the headers, you might see another "step1" for another OS.

You can refer to the guide's clickable "Table of Contents" and only follow the instructions for your machine's operating system.

[Thomas29]

To honest in a blunt way. It's only overwhelming it's confusing AF. It seems like the instructions are not in order I guess?

What operating system are you using?
For Windows, this explanation is brief ---> https://www.youtube.com/watch?v=TzOHLL_dKCM
For Linux there is one code you can use which is explained  ---> https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Follow the instructions and take a screenshot if nothing works (make sure to hide sensitive information)

BTW I'm using Windows 10 and I dd NOT verify the hash values of GPG4Win before I downloaded and installed it so I'm assuming it won't make a difference if I verify it now... even if it were worse case scenario?

Um thank you but now I'm stuck at step 3 due to the links for files I need leading me to a youtube video and the other leading me to this:


"-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBE34z9wBEACT31iv9i8Jx/6MhywWmytSGWojS7aJwGiH/wlHQcjeleGnW8HF
Z8R73ICgvpcWM2mfx0R/YIzRIbbT+E2PJ+iTw0BTGU7irRKrdLXReH130K3bDg05
+DaYFf0qY/t/e4WDXRVnr8L28hRQ4/9SnvgNcUBzd0IDOUiicZvhkIm6TikL+xSr
5Gcn/PaJFS1VpbWklXaLfvci9l4fINL3vMyLiV/75b1laSP5LPEvbfd7W9T6HeCX
63epTHmGBmB4ycGqkwOgq6NxxaLHxRWlfylRXRWpI/9B66x8vOUd70jjjyqG+mhQ
+1+qfydeSW3R6Dr2vzDyDrBXbdVMTL2VFXqNG03FYcv191H7zJgPlJGyaO4IZxj+
+O8LaoJuFqAr8/+NX4K4UfWPvcrJ2i+eUkbkDJHo4GQK712/DtSLAA+YGeIF9HAn
zKvaMkZDMwY8z3gBSE/jMV2IcONvpUUOFPQgTmCvlJZAFTPeLTDv+HX8GfhmjAJY
T5rTcvyPEkoq9fWhQiFp5HRpYrD36yLVrpznh2Mx7B1Iy8Rq/7avadwVn87C6scJ
ouPu+0PF3IeVmYfCScbfxtx1FaEczm8wGBlaB/jkDEhx0RR8PYKKTIEM7T2LH2p6
s/+Ei4V7mqkcveF/DPnScMPBprJwuoGNFdx2qKmgCKLycWlSnwec+hdyTwARAQAB
tBlUaG9tYXNWIDx0aG9tYXN2MUBnbXguZGU+iQI4BBMBAgAiBQJN+M/cAhsDBgsJ
CAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAr1YJLf5Rw5hlhD/9T4I/sBCleS9nH
njTJqcOnG28c9C3CRYIizjEui/pKmXz9fB1N9QrCaruPUQx2UacDVCl6dKxac+7s
s3/a6lsjaRn0/2OM/sCVLScyxNPNPQs2b6jkodSNPIM8zv51g+flhwtfrO6h6B4j
IhZgSjFdvqtZd5jaly9rA0uMX045CC4K6HGnq8n4F2p31z0L0LaHBf5EcsCM0MMp
QVkY0aUrNg9uVMGXBHn3osHnOtQaODqcIbpa/OG+Tlt6pVOiDJ7i8TkpQKT7sOaM
VdL//TEoDIOC7qVCN82q2q/gtiBXbziaERVs/eU0O52aX5qUhXu3VIjXTp/riRim
R/f9BPB1dgDZbF2aPZ/rJm26v82ft7gP1Sf52E9MrAaZATTfI0/TUHXeBzN93EA9
xb6/ENAMTX74u+NjlynWPD+hl64eBzJ2ionZF1bJFTgBkMfRYnhllvleCjcq9YfX
md5HKCwtxfygBIujUQSwyUzn0f5DbVCJ7/B19bKdvHGSSBgBEjxqXWQskm2wc0In
ww63goZAGDQliKhIT8xnwOBbLkqSobq4tD9zpQyxvMA2rhy7/gfFRp7TTak7MZHf
lTJ37S5LvcWHm/ccWUZDUN7akoEDc+m6jX3uIEPMD3PQvcHhWv0amco3zDr1qb/+
rXM7TJKd7DPX0E2dRzKu6aYRMTbklbQhVGhvbWFzIFZvZWd0bGluIDx0aG9tYXN2
MUBnbXguZGU+iQI4BBMBAgAiBQJTQDaRAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIe
AQIXgAAKCRAr1YJLf5Rw5hOBD/9o/NqHLvjhrCfy6/SblSC/udV9ujFnvhZZZprb
r8Oe6GdMwfw+ktZd2nYb09KjxXYmGoZeZKmvCb0LoMKSVWgisH1rgzDzI6UzFL4b
pV2+PqCSiWaekfnBm+oHbGgJCuAXebGXjVL8JsvhAl0HQZzTA1RX0u8TEAHOxOI5
l+mXSN+cwVZuDMpt5v+JDyPGHM/KqaXCw1WJY50mqlan6/15XHilmvY/CaxmbXNH
ZOXucmPxyCTeiQTqyhHsIBb4RxWYCaUXv9+svriotv2HZpQ110NN09ml1K1kDlNL
Zh3jNqMsbImFArbN8GikjqhRBV3K77Np4lccnsBPllQMqqQULG7UshcQTatkmTMb
j2TQ0oQWEZt0uJmnmxgz18ijs6m2fJZhlH0QYVYOwUvK6GfAFluHwOZHIXonv8Ck
uTW+P90lOB/9ZnREZeYb2wlvV6fCTMHxptIbT31kbLTzu4KEI6+ShQXT+YAKiC5S
JC9heheaeApH3wcLiZJcCKYv6ubY+3Uf/EoXcqWywwpS/nWkSpMSYjq+V9xCcGHI
MZ4vZkiZ6OS5Mu739rgGfP7Yi3pqUYLIpUa5QiNOMEhPtWbj/oH5ldaZowwgZ4MK
2Mzxex8IhFppPtZgqJfu9NZQLICpxcd2hUe3XWvB+jcvboZ1p7RO7ax3Vo9zy1fy
YEFML7Q9VGhvbWFzIFZvZWd0bGluIChodHRwczovL2VsZWN0cnVtLm9yZykgPHRo
b21hc3ZAZWxlY3RydW0ub3JnPokCOAQTAQIAIgUCVMYFygIbAwYLCQgHAwIGFQgC
CQoLBBYCAwECHgECF4AACgkQK9WCS3+UcOZ7BQ//VJuRmM7kQd5DcJS76BKpMtKt
gUNV3hi2h8kNGtkIeKhpeiK+PeweFJCb0nQDiEYsg5Xd/l5ZwN34cqlhgaQ8uWBY
rmNnSYGECLrxejx6WTWHp2AtD9BXrj73HEox2abC0Bdky39aCTyuRhSzbFnV2unh
L7IarKqr5bat6ywFZWsOcaisEjWXlTSD/hYqnkRX8vnBZRnRgHyi1yOvHsXGFB3x
O+P7JUb4E7BVzVRDJzMgcBhY5vTZ4Mnc8eIplNVI1TaF2hmhmnezvRF6XNYV1Ew9
t2/HE85+DqIBikUWYPTTxJiWUOwxXP9dVOEmNTcAgVThvMN7W+WoF7//qcNKmbPI
DyGU5xb/MLNrM+MWfavtkHNqcY0+cFf27z4mOxd2eEMDVxN/Fhq0HipugMEawaZ0
G9xsF/rZBzKgpu7+SvqRqxUn36vNz59vDlBYEXSng6nJobUdNb6iHo/rpZ6ZYHKx
mzrK5ROpmKs6zpPTOn8Hw29jxx07auzEIVEa8hzZaiqTfwI9yBwzhFQwNxmNaKRE
adxosvU1VyTvaEVmMmTx227MF1qhwq9yrSXtmKZJGiHRzyL4B4vAGrf9uK9GwzS2
TlyksRdjapw6Cqp8sUB2PUzHqYNWs0wSsZuxwVt6JSD4N8vpYTTF00LONKe2oLhj
GNxpH+BV3SqMHXQl9Ki5Ag0ETfjP3AEQAL5LYJiX5S4PG891TMihejh5KVgc36/R
zgWYJkE26K855t+WdAa6spHKR1RmpTTsnaTXaC/bNxJZq+0vi9GKlw94twEueu0v
Cniinpy6AFeydveCi+qdr5XQ4hx1DY11kntGBL2wMOtrZ4oAeFnntHYcAMYaMBY5
p8gd3WVR2dgIvpOcezQBLwhoMHnN6A+JEQ27ZHcolwDO9ic+t4YAtl552DP1xKbc
T4D1JD0J6W6FbUJElOXReSjNGCuSLZZTsCzMg0P6RHwWUKtDvRKrK/M3Nh/L2EsW
5mAQnYps6a+hyVkVd9kLsogtHPE4xv33pzbDB5Yj+2zqdjYUqO/ODfkP+HjNRvyj
uHL6W3bjU6FnuJQXX4llskls4hlKDPawa3cuWnsdafouAZOxWwBlGysRZ7BaHOFE
TOlAeUN1EYfFrckcfkYzTX7NDA0S99aX730z/c9XrnqM52OO9LrSFRnYZ+K3M8z2
FFvo9/ZtqqTDH0/oH+ay0CwtowSovZUoljAQ8zmmi8CtPDFHg4srae8YxW4fetn7
QtP6rOVRwQCyP12LztC7oYGOectU5G9GkVDubNW48Vuex0/upP9RORjKN8atBroS
cmomR5hShxmgdJBy4I/TDkVFbZq/hRPSTAHgnciEC67TYhszzXP3nTn5/Ah0wCGC
d3HfiNX6G7MdABEBAAGJAh8EGAECAAkFAk34z9wCGwwACgkQK9WCS3+UcOaJRA//
dLHRBjeAkNbRsY5GNTWUZzXr3VC5vNqpwpP9rK4QTAmpl3iU5F+wsgMG78iS2XOV
+ijZA8KvishletQJoNMxS1PU4sA4Y34hYb61ptHs+PmwNpcdgjAX+mCh9xQ0816G
yIaXtxtxacJJW3K07fqKIkJjISPOyTLSd+wl1LtRE2fA67pMmpMHG8t+RPq1dp/e
3qp6L7jc6X3U+bn2m7u2cgEVbuAnSaKGoMSMnsd71Ltf1b6/DwvZz/HBttEgcgSm
PleHUVyBD4LDrcjTDK7zdEMw7b/cPBnu6CmTcogFEqvB4n9Yodo+4ij7AndUTz4J
j1p8vFlnHvhRg82MDfGUPJ+ujBjbYXROs+WAmaCQ8TgjZ3dAFNFrOqAbYu6QlY2x
fu7vj+ruc6ArdmBrOlsJFmNsxFRJfgdUug5JFIUN77GbjisHjWem8cY3szuyEke8
H2pi803CAuVtkaoNmNDHsEBieft34Zo0V+A/q2wkix3S9vyRjOKqhGrW30qxnV6Z
FexueWuO3qOQ0ZU5/TIH0kft2n45/RexeBq/Ip52zE1vEvTkQmBCfCGZmqTu+9Ro
8qsjecxVNxyVPlwhlimryiQ+dPaJYaOSfiwEEMh2MyV5c6t6qN9n6jFdiCLOlmmH
ZFA8xDodsofQEmlv+I/xyEZ7na6nxbpZVuPC3B0JFtY=
=sUYl
-----END PGP PUBLIC KEY BLOCK-----"







 But idk if this ^ is what I need let alone useful to me in anyway at all to copy and paste it somewheere?

[Thomas29]

To honest in a blunt way. It's only overwhelming it's confusing AF. It seems like the instructions are not in order I guess?

What operating system are you using?
For Windows, this explanation is brief ---> https://www.youtube.com/watch?v=TzOHLL_dKCM
For Linux there is one code you can use which is explained  ---> https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Follow the instructions and take a screenshot if nothing works (make sure to hide sensitive information)

Thanks that's most helpful guide posted so far, but in that video I'm sent to a file to download when I click signatures next to electrum download file but it doesn't bring to a webapge to copy and paste the text like the youtube video shows it just a file that when I open it now with GPG4Win/Kleopatra installed it brings up a bunch of options 1st one stating I got 3 signatures that cannot be verified?

I'm stuck now at the Command Prompt part of the video and I thought it was because I installed the files onto my desktop instead of the downloads folders so I typed in that location instead but it just says it won't work? Wtf am I doing wrong damnit! This whole entire proccess is sooo discouraging and I felt fairly knowledgeable and confident regarding this until now.





OMG I'm  beginning to remember why I gave up on trying to accomplish this seemingly mandatory task FFS!

[tranthidung]

Three guides for Windows, Linux, Android.
[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message - Fingerprint
[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message (Linux Only)
[Android Tutorial] PGP Signature - Encrypt/Decrypt message

[o_e_l_e_o]

But idk if this ^ is what I need let alone useful to me in anyway at all to copy and paste it somewheere?

That is the PGP key of ThomasV, the lead dev of Electrum. You should import it in to Kleoparta by clicking on "Notepad", pasting it in, and then clicking on "Import Notepad".

Thanks that's most helpful guide posted so far, but in that video I'm sent to a file to download when I click signatures next to electrum download file but it doesn't bring to a webapge to copy and paste the text like the youtube video shows it just a file that when I open it now with GPG4Win/Kleopatra installed it brings up a bunch of options 1st one stating I got 3 signatures that cannot be verified?

You are almost there. You have confirmed that the Electrum file you have downloaded has been signed by three sets of keys. It is telling you the signatures cannot be verified because you have not yet told Kleopatra that you trust those three sets of keys as belonging to the Electrum devs.


Since you already have Kleopatra installed, the next step is to import the PGP keys of the three Electrum devs which sign the releases. As above, go to "Notepad", paste in the first key, and then click on "Import Notepad". Do this for each of three keys you will find here:
https://github.com/spesmilo/electrum/blob/master/pubkeys/ThomasV.asc
https://github.com/spesmilo/electrum/blob/master/pubkeys/Emzy.asc
https://github.com/spesmilo/electrum/blob/master/pubkeys/sombernight_releasekey.asc

Once you've done that, you should repeat what you did above to open the .asc file with Kleopatra. It should now show you that the three signatures are verified and you are safe to install.

[Thomas29]

Thanks a lot for the new guide ^   but my 1st question now (among many others) is does it matter what name and email address I use at step 1? I don't know where my "key" is located where I can back it up... is that step really necessary? I DON'T KNOW WHAT I'M READING trying to follow that tutorial!?

Also it seems i forgot my passphrase for my key do I just start over even though it says not to delete it?

OR I NEED a step-by-walthrough an up-to-date one if possible.... I'm using version 4.2.2 do I really need to update I know its old af but?



OFF-TOPIC: Is it possible to get Electrum on an iphone?