keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
899 stars 37 forks source link

Website fails to verify message generated by command line #3044

Open latkin opened 7 years ago

latkin commented 7 years ago

I have yet to understand what one can put into the website "verify" box and have it do anything.

Here is test message signed by command line:

keybase sign -m test
BEGIN KEYBASE SALTPACK SIGNED MESSAGE. kXR7VktZdyH7rvq v5weRa0zkP1syTF jT3tRJg4Uxp3oT8 kJfrPewpPTFpseI gCj3EZDG0DErOh0 2H7uFRqv8DoXPRY tiPWx1pXQT0x23f RiqF29o1nTgAkK7 oQRPA4N1aAo5inD TKKL2igrfcpKQMo CzuElFovhC5NT0m 3co04Lc4nVyibws v0QTpUJSXTQ. END KEYBASE SALTPACK SIGNED MESSAGE.

Command line verify works:

keybase verify -m "BEGIN KEYBASE SALTPACK SIGNED MESSAGE. kXR7VktZdyH7rvq v5weRa0zkP1syTF jT3tRJg4Uxp3oT8 kJfrPewpPTFpseI gCj3EZDG0DErOh0 2H7uFRqv8DoXPRY tiPWx1pXQT0x23f RiqF29o1nTgAkK7 oQRPA4N1aAo5inD TKKL2igrfcpKQMo CzuElFovhC5NT0m 3co04Lc4nVyibws v0QTpUJSXTQ. END KEYBASE SALTPACK SIGNED MESSAGE."
Signature verified. Signed by latkin (you).
test

Website claims it doesn't even understand what the message is:

image

strib commented 7 years ago

The website only works with PGP messages. The command you used generates Saltpack messages. You can use keybase pgp sign and keybase pgp verify if you want to generate messages that the website will understand (if you have a PGP key set up for your account, which is optional).

maxtaco commented 7 years ago

We ought to (1) fix the error message; and (2) allow saltpack encryption and verification in the Web site. Haven't gotten around to it yet... Thanks for your patience...

latkin commented 7 years ago

Ok, thanks. How do I know when to use Saltpack and when to use PGP?

strib commented 7 years ago

I guess it depends on who you're sending it to. Anyone with a Keybase device listed in their profile can receive Saltpack messages. And anyone with a PGP key listed can decrypt PGP messages.

fiatjaf commented 7 years ago

When in doubt, use PGP.