4

Got the latest Tor Browser Bundle (3.5.2.1) and tried to verify.

Here's the result:

gpg --verify /Users/user/Downloads/TorBrowserBundle-3.5.2.1-osx32_en-US.zip.asc /Users/user/Downloads/TorBrowserBundle-3.5.2.1-osx32_en-US.zip
gpg: Signature made za 15 feb 12:46:23 2014 CET using RSA key ID 63FEE659
gpg: Good signature from "Erinn Clark <[email protected]>"
gpg:                 aka "Erinn Clark <[email protected]>"
gpg:                 aka "Erinn Clark <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8738 A680 B84B 3031 A630  F2DB 416F 0610 63FE E659

Why the WARNING, why is that key not certified and why a space between A603 and F2DB. Also, Erinn Clark has a newer key of sept. 2013 in stead of oct. 2003. Why doesn't GPGTools use the latest key? Thanks, SK.

Improve this question
0

3 Answers 3

Reset to default
4

This message comes from GnuPG. It tells you that you have not related some kind of trusted relationship to the key of Erinn Clark. When you meet her one day and you do a keysigning (compare your keys and your identities), you can sign her key. Now your GnuPG treats the key as known and trusted and the warning disappears.

Furthermore maybe you took part in keysignings before and have signed other keys. This can build a transitive relationship. You can see my case in the picture below.

My main key at the bottom of the page has/is signed by another key of mine. This key has/is signed by several other people. Many of them I know and trust. Those people also signed Erinn's key. So this gives me also trust that the key really belongs to Erinn.

key relationship between Erinn's key and Jens' key

Erinn Clark has used her old key to sign the release of Tor Browser Bundle. Maybe in the future she might decide to use her newer one. But this decision is up to her. You only can use GPGtools to verify the signature, not advise it to take any special key.

Improve this answer
1
  • Great illustration. How did you produce it?
    – Chiffa
    Commented May 30, 2014 at 21:32
2

The digital signature of the archive is verified, and that it matches the excepted Erinn Clark's public key she used to sign this document. For the question of the trust, you may refer to: http://gnupg.org/gph/en/manual/x334.html

For the two space in the fingerprint, this is just a conventional format.

Improve this answer
2
  • Thank you very much, so judging by the Good signature alone I can tell that the downloaded file has not been tampered with? SK.
    – Stephen
    Commented Feb 20, 2014 at 17:36
  • It is possible, if unlikely in practice, that someone has given you a tampered file and a tampered key. When did you first get the key? From where did you get the key? If you get the key again from a different computer on a different network, is it the same key? If so, the likelihood of you having a tampered key to go with a particular tampered file is minimal.
    – rdump
    Commented Feb 21, 2014 at 18:50
0

In addition to what other people already stated:

Please be careful with Erinn Clark's (and every other) signature! There are people putting fake keys online:

https://lists.torproject.org/pipermail/tor-dev/2014-March/006422.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .