Another feature that I want to cover in this lecture is how to sign a file without encrypting it.
So maybe you want to actually transfer this picture over the Internet, but you're okay with people
seeing the content of the picture.
You only want to make sure that the sender is able to verify that this picture was actually sent by
you and that it was not modified since you created it.
So this is similar to what the tails or the developers do when they create a new version of the application.
And that's what I showed you at the start of the course when we were validating and making sure that
the files that we downloaded did not get modified and are actually created by the Tor or the Tails creators.
We can do this by simply signing the file without encrypting it, and we can do it also using Cleopatra.
So again, I'm at David's computer here, as you can see with the one with the green background, you
can see that I have David's key pair, the private and the public.
And I only have John's public key.
So what we want to do, we want to sign this image, this picture as David, but we don't want to encrypt
it.
So all we have to do is again, click on sign, encrypt, select the picture that we want to sign.
And it's the same picture in here.
And this time we want to sign it as David, but we don't want to encrypt it at all.
So we don't want to take any of these boxes.
And that's it.
Now, as you can see, as a result, you're going to get a file that has the same picture name but ends
with a dot sig with a dot sig extension short for signature.
And once we click sign in here and the process is successful, you'll be able to see an extra file in
the same location that we selected and it has the Sig file.
So this is simply a signature for this file right here.
This signature corresponds to this current version of the file.
And if this file is modified in any way, shape or form, it will break the signature.
Therefore, what we need to do now is send this file as is, along with the signature.
As a result, people can make sure that this file did not get modified by validating this signature.
So again, you can transfer this any way you want.
We covered that previously.
I'm going to pause the video and resume once I have it downloaded at John's computer.
So now we're back to John's computer and I have the image sent as is unencrypted along with its signature
right here.
And assuming John was able to download this from the Internet.
And all we want to do right now is make sure that this file or this picture did not get modified.
And we're going to do this using the signature.
It's very important to make sure that the file and the signature are stored in the same directory and
have the same name.
As you can see in here.
We're just going to select the file and it will automatically find the signature within the same working
directory.
And doing this is very, very easy.
Again, using tails, we're simply going to click on Decrypt Verify, we're going to select the file
that we want to check its integrity In this example, it's this picture right here.
We're going to click open and we're going to click on the audit log.
And as you can see, it's telling us right now that there is a good signature from David again, meaning
that this signature was created by David and that this picture did not get modified since this signature
was created.
Now, as you can see, I've only selected the picture when I was checking the signature because the
signature exists in the same directory and it has the same name as the picture.
So it is very important to have the picture and the signature in the same directory and have the same
name.
And this way it allows the sender to verify that this picture was actually sent by you and that it was
not modified since you created it.