Digital Signature ASC Made Easy

Digital signature asc

hey guys crypto dad here again thank you for joining me on this video series where we talk about all things encrypted cryptographic functions there's a lot of software out there that we might be interested in that we need to install on our computer and I'm going to go through a lot of these with you and later series later videos but right now we're kind of focusing on software verification which is very important to this whole process on my previous video I went through the whole explanation of what software verification is now I want to take a little more advanced and just show you a little quirks when you're downloading other types of software than just to our browser so let's go right into this okay so we're here on the tour web site and we did this last time we downloaded tor and there's a download button here and there's a signature file which leads over to this cryptic graphic text and it's a little daunting it's a little intimidating a little complicated to do and I explained to you that what you need to do to run these verifications is to install GnuPG on your computer so that you'll have the right software for running these cryptographic functions it sounds a bit complicated but we went through that okay and we talked a little bit about GPG for Windows I'm helping some Windows users here today and when we download this onto our computer for the first time we've never used it before it makes a little hard to run the verification on this install because it's like a chicken and the egg thing how can we run the verification if we haven't installed the software how can we install the software if we haven't verified it yet you know it could be a malicious software it could have been altered in transport which is why we do all this from the from the get-go so I'm going to go through some alternate ways to verify the GPG software for Windows I'll go ahead and download it we won't donate today and we get our little window here that asks us where we want to save the file I mentioned you I like to create folders on the fly as we go I could like to keep things organized I have a software folder here on my data drive and I'm going to create a new folder called a GPG for win okay just download there okay so how are we going to check this okay so if we go back here and we go to verify check integrity you'll see that we have some open PGP signatures now these open PGP signatures can be used to verify the software installer but if we've never run this software before if we don't have a previous version of this software we're not sure that we're using a trusted version that's long and short of it so a good way to check it without running the verification is to use a sha sha some checker okay they generated these here for us okay and I'm going to I have sha some checker on my computer I'm going to browse over to the file and we just downloaded and see if it gives me the right sha yes it does okay so basically it needs to match this shot checksum that we have up here this is the software that we downloaded the GPG for Windows 2.3 and this is the Shah it's a bit long so we can cut and paste it into our Shah some checker click paste it verify lo and behold the sha-1 matched okay now this is great software I have it installed on my computer but you may not and I just wanted to go over one little thing here if we Google saw some checker we're going to get the md5 in shot chat some utility up here and we also have an online version which is easy to use we do the same thing we click browse we go to our file I'll show you the column just download it okay BAM actually it didn't do it the way I expect it off in sha-1 okay so we got 670 which is very close to what we have before we can paste in [Music] now I can't compare and sure enough we get a little check mark what I wanted to point out real quick is that if we follow this link here to this guy over here hey you know I I like ads as much as the next guy but a lot of these software downloaded pages when you click download now they want you to use their little downloader which might install some piggyback software throw up ads and all kinds of crazy stuff okay so it's much easier if I let's go back here see if I just once I know the name of the file that I'm going to download after my sort of generalized Google search I can paste that in which you can see I already did before hit Search and it's going to there's this ad filled thing over here but we also have a nice little quiet guy who's going to let it let us download it without all of the ads and whatnot so once you know the name of the file you can look for it by its name and usually find a quiet little site or the developer site that you can download without all the blocks now in the GPG for windows here they mentioned that okay so you've downloaded this software from their website you've used this shaw some check checksum from their website oh wait a minute what if the attacker impersonated the entire website gave us the the foe installer and the foe checksum so their advice is to find this checksum from a different site or a different channel so to speak okay so over here they have the release announcement which takes us to a different website that has the SHA some sha-1 hash down here and then to be much more secure you could subscribe to their mailing list so that you get an email with these announcements and you can take your sha 1 hash from there so you know you're not being duped this is rigorous software ok so I'm going to go ahead and run the installer one more time I'm going to block that remember me okay yeah these these hoop law sites are messin with me right we want to avoid those type of things all right so let's go over here to our GPG for Windows and our nice software folder which we verified with the shell sub checker and we're going to run the installer I did this in the last video and we want to tick GPA okay and once we get this installed we want to get easy access to it and I'll show you my way doing it not telling you what to do but there are different ways that people like to keep their software organized if you'll notice I like to have a clean desktop with all of my programs down here along the taskbar so we can do that with this new software that we downloaded let's pull up the windows menu scroll down here to the G's and find our gbg4 window and the GPA which is our front end I'm going to right click on that choose more pin to taskbar and there we've got it so run our software for the first time and I believe we will not generate our own key now we'll do that later it's not necessary for what we're doing so now we have our little front end here that shows us our team manager as you can see it's empty there's no keys in there these are signing keys and but I do have the software downloaded so we can oh we haven't done tour yet let's take care of that so we're going to download tour we're going to save file we're going to create a folder in the software call this one tool and we'll download that by the way if you want this file to pop up like that in your settings over here on the hamburger menu go to options we want to make sure that always ask where to save files is ticked we don't want to just drop them into downloads you might it's convenient they're always in the Downloads folder but I like to have a little more control where I put my files when I download them I keep them organized all right and we can click on this down folder here to open up the folder okay so we need to download the signature for the tour and put it in the GPD fool oh boy I'm just getting all messed up ironing we're going to put it in the tour folder so we went through this last time we've got the cig file with all this cryptographic text we're going to right click here save link as put it in tor folder go over here we can run the verification by right-clicking and we are going to get a fail because the key is unknown so there's a few we need more than just the file and the Installer in the signature file we actually need the signing key of the developer okay so how do we do that we go over here to the what's this we can scroll down a bit to their signing keys page and we see the tor browser developers signing key is right here this is the key ID I'm going to select and copy go over here to GPA and I'm going to use the server function retrieve keys and I'm going to paste that little key ID in there and hit OK ok and then going to get that we downloaded the tor browser developer signing key and when we do our verify this time okay it's going to tell us the key is not valid well this front end failed at this point to give me a good explanation of what occurred it threw up a kind of an error slash warn message but it doesn't have as much information as I would like so I'm going to show you guys we want to enter into the Windows PowerShell here we'll hit the shift key and right-click to get this pop up it's going to open up right there for us okay we're going to run the command line here GPG verify okay I'm going to take this file here I'm going to select it and I'm going to hit control C copy and then I'm going to paste space and paste again and the reason I did that is because if you'll notice the filenames are the same and I need the signing key I'm sorry I need the signature file first which has a SC extension but the second parameter is going to be the Installer itself which has the exact same name - that little extension so now I have the two parameters in there the way I need them I'm going to hit enter and it's going to give me that it is a good signature from the tor browser developers but there is a warning that the key is not a trusted signature there's no indication the signature belongs to the owner okay we've gone through this before we don't know and it's also thrown up the fingerprints for us just in case you want to check so if we just download this from a website we don't know for sure if this is indeed the signing key of the tor browser developers we need to verify this in person that's the best way I meet a tor browser developer he writes down his fingerprint and gives it to me and I take it home and I compare it to this fingerprint that gets generated and then I know for sure that this was the tor browser developer and the signing key that he created we can do this through a friend of a friend we take this - what this this is what's called the circle of trust so a friend of a friend knows a tor browser developer he can get the fingerprint from him give it to me and this chain can go on even longer if we want a friend of a friend of a friend that's why we call it the circle of trust okay and there is a quick and dirty way to check this fingerprint - we can just go to the website and scroll down here to the tor browser developers signing key and just look here and we've got this fingerprint and it does match the one that we got ef6 key and ends in 8 - 9 0 well that's all well and good so we've got a pretty good fingerprint a pretty good idea that this is fingerprint so for demonstrative purposes i'm going to give this signing key full trust by right-clicking set owner trust and i'm going to go to ultimate this is the assumption that i have validated the key that i know that it's the right key given an ultimate trust and now we're going to up arrow and run our command again and we're going to get a nice good signature without any warning okay so we're also going to do this in a different way using the electron bitcoin wallet as our example we're going to go to download here download windows installer kind of take this into software as well I like to create this folder so that we have the two files next to each other and there's not a lot of other junk in the way okay so let's go to the signature now this time I'm just going to cut and paste this whole mess since Starmie let's go back here okay okay here's the electrum installer that we downloaded I'm going to create a new text file has to be a text file - we don't want rich text or Microsoft Word because there's formatting in there let's open this guy up and we're going to paste that signing key in there are on pardon me that signature file we'll save it and I'm going to give it the same name as this file and we're going to give this to 8fc extension it's going to bark at me about that and I'm going to say yes okay I am showing extensions right now when you go to your View menu options in Windows 10 we want to go over here to view see this little this is usually the default so you don't see extensions you'll notice that both of the extensions just kind of disappeared but for our purposes I like to show the extensions it makes it easier to edit the file names but I'll leave it back on my default I'm going to open up a windows powershell here again to fast they're already in the sky log okay so we're going to do our GPG verify and we're going to cut and paste again ctrl C it won't let me right click that for some bizarre reason I can right click paste twice and to take the a is the extension off the so that it becomes the installer file name okay there's no public key we're going to the electrum website has the signing key right up here and we're going to do that same little business there copy we're going to go to the GPA 2 server again retrieve keys paste and ok all right so now we have the signing key in there and we can run the command again so in that case I basically ran you through everything tells us we got a good signature but that the key is not trusted we're going to assume that we met this developer as well set owner trust to ultimate ok and then we're going to which by the way I don't think that's best practices I think most of the time they want you to just accept this ok they want you to say ok that's fine we know it's not trusted but we've got a decent signature we can run our installer I like to see no warnings so I've set trust ultimate but I think best practice is to just accept the fact that you don't have a trusted key all right so I'm going to go through another website where we have verification involved the Bitcoin website we want to get started with Bitcoin choose wallet will choose Bitcoin core and we're going to run the install and it's going to take us over here to this ok I'm going to download the well if I click there I'm going to the Windows 64 installer I'm going to save it I will put it in software again create a new folder alright now this time when we could verify relief signatures it's going to give us this crazy thing here it doesn't take us over to a webpage with a tag signing release key it actually downloads the file itself so in this case I'm just going to drop it what happened there and it just kind of opened Oh I chose open my bad okay so we're going to save file we're going to put it in our Bitcoin core and then let's go over here and check see what we got okay we got the file next to it let's just run the verify was our right click and see what happens okay cat tells us that it's an unknown key we knew that let's get the key and here they give us these release keys and then we're as you can see over here we downloaded version 10.1 4.1 so we want the version point zero point 1 1 and higher this little plus okay I'm going to save this guy too all right I'm going to save it here now in this case the signature of the release signing key was a file that we downloaded so in this case we're going to use GPA and we're not going to go to server because we didn't get the key ID we actually got the signing key we're going to run import and we're going to go over here to software pardon me getting all the klimt here okay we want the Bitcoin core or is it guy here it is okay we're going to open it see that that's the release key we're going to hit open it just imported our keys for us and that wonderful okay so that's just another method of getting the signing key you know we can also do this in the command line as well there's a receipt keys command and there's also an import command on the command line so let's go back over here Bitcoin core now let's run our verify again now that we have the signing key key not valid okay on certain signature okay so let's give it full trust and let's right-click again and you are verifying hey now we got the ballot this is what we like so I've shown you a few methods for verifying software a few things that might trip you up if you've learned to do things a certain way so we went through a couple of different ways of verifying software and I hope you join me for as we start to get more into the meat of what I want to show you guys I'm going to show you how to stay anonymous on the internet I'm going to show you how to download install and a Bitcoin wallet and how to get Bitcoin how to buy Bitcoin how to you know spend Bitcoin anonymously if you want a lot of great things that we can do with encryption so I hope you guys will join me I've got a little goodbye so goodbye everybody thanks for joining me and I hope to see you again Thanks