Words / Pair 35 of 41
The result is good. Whose key was it?
Your software reports a good signature and it is not lying to you. It has answered a narrower question than the one you had in mind.
What a good result actually says
Verified, and worth nothing to you
The maths worked. Some key produced this text and not a character has moved since. That key belongs to nobody you ever agreed to trust, and it may have been made this afternoon with any name inside it.
Verified, and worth something
The same maths and the same clean line on screen, but the verifying key is one whose fingerprint you held before this message arrived. Now the result carries weight, since only the holder of that private key could have produced the text.
Verification answers one question. It asks whether the holder of a particular private key produced this exact text, and whether anything has changed since. That is a real answer and a useful one. It is also the whole of the answer.
What it never touches is who that holder is. A key carries a name and an address inside it, and both were typed by whoever built the key. Anybody can build one today with any name they fancy. The software will not object, and the clean result looks the same as the one you get from a key you have used for a year.
The question you thought you asked
You wanted to know that the market wrote this. What you were told is that a key wrote this. The gap between those two sentences is where most of the money in this section goes missing. Closing it takes one comparison, and staring harder at the result line will not do it for you.
It matters most on any message that asks you to move. A new address, a different deposit destination, a mirror you have not used before. A stranger who signs their own forgery gets the same clean result as everyone else, so that result on its own separates nothing at all. The string you should be comparing is covered in a matching fingerprint against a matching name.
Read the key, not the verdict
Look past the good or bad line to the key that produced it, then compare that key fingerprint against one you obtained earlier by a different route.
- Find the fingerprint of the key your software used for the check. It is a long run of hexadecimal, not a name and not an address.
- Find the fingerprint you already hold, from wherever you first wrote it down. If you never wrote one down, there is no test to run and the result is decoration.
- Compare them the whole way along, middle included. Two keys can share their last four characters and share nothing else.
What each comparison is worth
| What you compared | What it lets you conclude |
|---|---|
| The result line on its own | Some key signed this text and the text is intact. Nothing whatever about whose key it was. |
| The name inside the key | Whoever built the key typed that name in. It is free text and costs nothing to imitate. |
| The fingerprint against a note you made earlier | The holder of that specific private key produced this text. |
| The fingerprint against one printed in the same message | Nothing. The message is vouching for itself. |
That last row is the trap worth naming out loud. A forged notice will often carry its own fingerprint underneath, neatly set out, matching perfectly. It matches perfectly for the plain reason that both halves came from the same author.
The expensive direction
- If you treat the right key as the wrong one
- You stall. You refuse a genuine notice, carry on with what you were already using, and spend an evening hunting for a second source. Irritating, and paid in time.
- If you treat the wrong key as the right one
- You act on instructions written by whoever built that key. In practice that means sending money to a destination of their choosing, with nobody to appeal to afterwards.
- If it is the wrong key
- Stop reading the message as information. Use no address out of it. Go back to wherever you first recorded a fingerprint and work forward from that record.
- If it is the right key
- Treat the text as coming from the key holder and no further than that. Then check whether the signer put a date in it, since a valid old notice reads exactly like a new one.
Questions readers send about this pair
Does a good signature mean the message came from the market?
No. It means the holder of one particular private key produced the text. Whether that key is the market key is a separate question, and the only thing that settles it is a fingerprint you obtained before the message turned up.
Two keys carry the same name. Which one is real?
The name proves nothing, so the name cannot answer it. Compare fingerprints against your own earlier record. Without an earlier record you cannot settle it from the message at all.
My software says the key is untrusted but the signature is good. What is that?
It is telling you the maths worked while noting that you never told it to trust this key. The two lines answer different questions, and the untrusted line is the one about identity.