1

Since the introduction of the new Tails signing key, which I think was towards the end of 2015, I have had variable success in verifying my download of the Tails ISO file. For example, to verify the tails-amd64-3.6.iso file, I enter the command

gpg --keyid-format 0xlong --verify tails-amd64-3.6.iso.sig tails-amd64-3.6.iso

which returns the informative message:

gpg: Signature made Tue 13 Mar 2018 11:41:20 AEDT
gpg:                using RSA key 0x3020A7A9C2B72733
gpg: Good signature from "Tails developers <tails@boum.org>"
gpg:                 aka "Tails developers (offline long-term identity key) <tails@boum.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F
    Subkey fingerprint: 2FAF 9BA0 D65B B371 F0BC  2D46 3020 A7A9 C2B7 2733

However, when I attempt the same with the tails-amd64-3.6.1.iso using the supplied signature file tails-amd64-3.6.1.iso.sig, using the command

gpg --keyid-format 0xlong --verify tails-amd64-3.6.1.iso.sig tails-amd64-3.6.1.iso

I get the following output:

gpg: Signature made Sat 17 Mar 2018 11:08:42 AEDT
gpg:                using ? key 0x90B2B4BD7AED235F
gpg: Can't check signature: unknown pubkey algorithm

What is going wrong, and what is it that I should have done, or be doing?

I realize that there is always the remote possibility that I have downloaded a fake Tails iso file. For what it is worth,

sha256sum --binary tails-amd64-3.6.1.iso

gives

826c8fc05a7fb04962c6a45350648fc9273bf98f8b19b2d5a491b440d78ecbf6 *tails-amd64-3.6.1.iso

NEW INFO ADDED 2018-03-23 : I have installed the Tails verification extension in Firefox, which verifies the download. However, I'd still be very interested to know why the gpg check fails (despite the same approach succeeding with the 3.6 ISO)

1

The error "unknown pubkey algorithm" is a consequence of (a) the fact that on my machine, the gpg command defaults to using gpg1, (b) gpg1 does not support the use of elliptic-curve cryptographic algorithms, and finally, (c) the Tails version I was trying to verify was signed using an elliptic-curve algorithm. For a discussion about the history of gpg, see the Wikipedia entry.

The solution is to ensure that gpg2 is used instead of gpg1. So, for example, the verification command would read

gpg2 --keyid-format 0xlong --verify tails-amd64-3.6.1.iso.sig tails-amd64-3.6.1.iso

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.