Signify (OpenBSD)

signify is a free and open source tool developed by OpenBSD to generate and verify signatures.^[1]

It makes use of Ed25519 and was created to enable the OpenBSD project to sign releases while not having to use GnuPG since its code complexity didn't comply with OpenBSD's standards for security and maintainability.^[2]

Contrary to OpenPGP keys, signify keys are meant to be rotated frequently and are not tied to an identity.^[2]

OpenBSD for example includes the next signing public key in each release. When version 5.6 was released, the keys for version 5.8 were generated to be included in version 5.7.^[2]

The creator of the signify utility, Ted Unangst, wrote in 2015, speaking of OpenPGP and GnuPG: "The concerns I had using an existing tool were complexity, quality, and complexity."^[2] This is in line with the project's longtime tendency to reduce complexity, and in turn, reduce the probability of vulnerabilities existing in the software, and help the user understand the software better and make more security-educated decisions. signify is integrated into the base operating system and used for verification of all releases, patches, and packages starting with OpenBSD 5.5.^[5][6]

signify public keys are 56 base64 characters. The first two bytes of the decoded data specifies the algorithm.^[7] The only currently supported algorithm is Ed25519 with the ID "Ed" but other algorithms can be added, for example to extend the software with post-quantum cryptography.^[7]

The key and signature formats are prepended with an untrusted comment that can be manipulated and shouldn't be relied on.^[7][1]

untrusted comment: signify public key
RWT8aOqwyEbFcBqOgENsuEDD2h8uBCWKxcX+Fv1QQk7IGUrKhbcZUY09

untrusted comment: signify secret key
RWRCSwAAAAARy9ex6GaxBnbYJirsxcF6LGvFOt5iF+n8aOqwyEbFcORd11nFXvrzBLfyRObCJ+JlSh7CKVBgOE3t108hAl9AGo6AQ2y4QMPaHy4EJYrFxf4W/VBCTsgZSsqFtxlRjT0=

untrusted comment: verify with key.pub
RWT8aOqwyEbFcNswGh6YdUTl1JQ4ifAzmNjGQQVkcH2MIfH6In3xVgishY1k9JjL7TLMuUDsLGXNfXxIFHTZpSZ58qk5SJVy/gQ=

untrusted comment: verify with key.pub
RWT8aOqwyEbFcLj0u4//hJEOZBa3+e1FFhv8d1HUwgZDcG0PgL5lBO9veYucAn5NxuPc9qCSIaXZ6PoUX4GBcp
Ds0Pup81YhqA0=
Hello world!

signify has 4 possible modes:^[1]

signify -G [-n] [-c comment] -p pubkey -s seckey

to generate a new keypair and save the public part in a file named "pubkey" and the secret part in a file named "seckey"

signify -S [-enz] [-x sigfile] -s seckey -m message

to sign a file named "message" with the private key saved in "seckey" and store the signature in a file named "sigfile. Specifying -e embeds the message after the signature.

signify -V [-eqz] [-p pubkey] [-t keytype] [-x sigfile] -m message

to verify a file named "message" with the public keys stored in a file named "pubkey" and the signature stored in a file called "sigfile. Specifying -e extracts the embedded message from the signature and writes it into the message file.

signify -C [-q] [-p pubkey] [-t keytype] -x sigfile [file ...]

to verify a list of signed files with the "sigfile" being a signed list with the embedded output of the sha256 command.

Apart from the obvious usage in OpenBSD, other projects also use signify:

• GrapheneOS^[8]
• OpenWRT (slightly modified variant called usign)^[9]

In contrast, other Free Software operating systems and security-focused software tend to use OpenPGP for release verification, and as of 2024 continue to do so, including: Debian, a prominent operating system that's also used as a base for other operating systems, including Ubuntu;^[10] Kali Linux, a specialized operating system for penetration testing, security research, digital forensics, and reverse engineering;^[11] Qubes OS, a security-focused operating system;^[12] Tor Browser, an anonymous Web browser;^[13] SecureDrop, a software package for journalists and whistleblowers to exchange information securely and anonymously over the Internet;^[14] and VeraCrypt, a software program for on-the-fly encryption and full disk encryption.^[15]

This cryptography-related article is a stub. You can help Wikipedia by expanding it.

• v
• t
• e