Re: pgp key

[Felix Lechner via <help-guix@gnu.org>]

Hi Gottfried,

On Wed, May 01 2024, gfp@posteo.at wrote:

> I would not like to send it unencrypted, so that somebody may misuse
> it during the sending.

What type of misuse do you envision?  If you want to share the song with
the world, you are not looking for encryption.  That would help keep
your song confidential.

Are you looking for signatures?  When used properly, they prevent
someone from tampering with the content you distribute.

There are two way to do that.

You can sign a PGP/MIME email with PGP.  That happens regularly on Guix
mailing lists, although probably more often on guix-devel.  Here is how
to do it in Emacs's Message Mode. [1] Most modern mail clients will
automatically check the signature and light up when the message was
modified in transit.

You could also publish "detached signatures."  Those are basically
hashes of your songs (with algorithms like SHA-512) that you sign with
your private key.  GnuPG is a tool that allows you to do that [2]
although it would be good to remind recipients that they should verify
your signatures manually.

Kind regards
Felix

[1] https://www.gnu.org/software/emacs/manual/html_node/message/Signing-and-encryption.html
[2] https://www.gnupg.org/gph/en/manual/x135.html