Gpg4win installer signature validation: how to fix “WARNING: This key is not certified with a trusted signature!”

certificatecertificate-signing-requestgpg4winsecurity-warningsignature

I am following the install guide of "OpenPGP signatures" of Gpg4win at Check integrity of Gpg4win packages.

Having also followed additional advice of how to import the Gpg4win public key first, I end up with a warning, which has been mentioned as a side-note answer at How to verify downloaded file with .sig file?, without making a new question from it:

gpg: Good signature from "Intevation File Distribution Key <distribution-key@intevation.de>" [unknown] 
gpg: WARNING: This key is not certified with a trusted signature! 
gpg:          There is no indication that the signature belongs to the owner. Primary key fingerprint: 13E3 CE81 AFEA 6F68 3E46  6E0D 42D8 7608 2688 DA1A

Same in Kleopatra, saying

"Der verwendete Schlüssel wurde weder von Ihnen noch einem anderen vertrauten Schlüssel beglaubigt."
translated: "The key used has not been authenticated by you or any other trusted key."

The advice from How to suppress "WARNING: This key is not certified with a trusted signature!" does not remove the warning in my case:

C:\Users\USERNAME\Downloads\gpg4win>gpg --lsign-key "13E3 CE81 AFEA 6F68 3E46  6E0D 42D8 7608 2688 DA1A"

outputs:

pub  rsa3072/42D876082688DA1A                                                                                                 
erzeugt: 2016-11-03  verfällt: 2021-11-02  Nutzung: SC                                                                  
Vertrauen: unbekannt     Gültigkeit: unbekannt                                                                     
[ unbekannt ] (1). Intevation File Distribution Key <distribution-key@intevation.de>                                                                                                                                                            
gpg: no default secret key: Kein geheimer Schlüssel                                                                                                                                                                                             
Schlüssel ist nicht geändert worden, also ist kein Speichern nötig.

or in English, translated with www.DeepL.com/Translator (free version):

pub rsa3072/42D876082688DA1A 
created: 2016-11-03 expires: 2021-11-02 usage: SC 
trust: unknown 
validity: unknown 
[ unknown ] (1). Intevation File Distribution Key <distribution-key@intevation.de> 
gpg: no default secret key: No secret key 
Key has not been changed, so no save is needed.

Checking the "verify" script again throws the same warning:

C:\Users\USERNAME\Downloads\gpg4win>gpg --verify gpg4win*.exe.sig gpg4win*.exe                                                     

gpg: Signatur vom 25.11.2020 13:39:05 Mitteleuropõische Zeit                                                            
gpg:                mittels RSA-Schlüssel 13E3CE81AFEA6F683E466E0D42D876082688DA1A                                          
gpg: Korrekte Signatur von "Intevation File Distribution Key <distribution-key@intevation.de>" [unbekannt]              
gpg: WARNUNG: Dieser Schlüssel trägt keine vertrauenswürdige Signatur!                                                  
gpg:          Es gibt keinen Hinweis, daß die Signatur wirklich dem vorgeblichen Besitzer gehört.                       Haupt-Fingerabdruck  = 13E3 CE81 AFEA 6F68 3E46  6E0D 42D8 7608 2688 DA1A

How to fix the warning?

Side-note: I have seen that one of the signature validation points is not fulfilled. Could that be the reason? It says that the certificate is valid till Saturday, 30. April 2022 17:54:41, but the Gpg4win website lets you check the code signing certificate to be valid not after 16:54:41 of that day.

notAfter: 2022-04-30 16:54:41

Best Answer

The advice from How to suppress "WARNING: This key is not certified with a trusted signature!" does not remove the warning in my case:

Technically, you didn't implement the advice. You can see in your output that the command didn't do anything because it was unable to find a private keypair – so nothing got signed even though the command was run:

gpg: no default secret key: Kein geheimer Schlüssel
gpg: no default secret key: No secret key 
Key has not been changed,

--lsign-key and similar signing commands use your private keypair to sign things, so they will only work once you have imported or generated one.

Until that's done, just manually compare the signer fingerprint from --verify with the one you got from the website. If the fingerprints match, the warning can be safely ignored.

Side-note: I have seen that one of the signature validation points is not fulfilled. Could that be the reason? It says that the certificate is valid till Saturday, 30. April 2022 17:54:41, but the Gpg4win website lets you check the code signing certificate to be valid not after 16:54:41 of that day.

You're in a different timezone. Windows shows you the timestamp in local time, but certificate validity is always stored as UTC time, so it always becomes invalid at exactly the same moment (16:54:41 UTC) no matter where you are around the world.

Side note: Authenticode signatures are timestamped (unlike PGP signatures), so once a file has been signed it'll remain valid even after the certificate expires.

Related Solutions

Why trust a public gpg key

"mark the key as trusted" . How do I know this public key was not tampered with/modified? Why should i trust it?

Your problem here is basically a problem inherent with public key cryptography. How do you establish trust at the very beginning.

If the truecrypt.org web site was hacked, could theoretically modify the binaries, re-sign them with a new key, and then publish the new key.

There are a couple imperfect remedies to this.

One is simply to lookup the key on public key servers. The assumption/hope is that an attacker would not have the ability compromise both the original site, and the well known key servers.

One of the more popular public key servers is http://pgp.mit.edu/. If you search that public key server you can a public key listed for contact@truecrypt.org with the ID(short) F0D6B1E0, that public key on pgp.mit.edu matches the key posted on the truecrypt.org web site (or at least it does when I visit the site). The long ID is 0xE3BA73CAF0D6B1E0.

Anyway, the hope is that if you can confirm the key by finding it published and identical in multiple locations, than you have gotten the valid key.

If you still don't trust the key servers, then you could try to get a copy using some out-of-band method. Have someone you trust you a copy in an email, or an IM, on a flash drive in the mail or something.

There is also the hope that if the site was compromised it would be noticed by many people and quickly publicized. A security breach of the key servers, or the truecrypt site would be pretty major deal, and you would probably be able to find out about it.

How to suppress “WARNING: This key is not certified with a trusted signature!”

Any page that tells you to use --edit-key <id> trust in order to suppress this warning is, generally, going in the completely wrong direction. The confusing message actually has nothing to do with the key's trust setting. A trusted signature is one that was made by a valid key:

Key validity defines whether this key belongs to the person that it claims.
Key trust defines whether this key is allowed to sign other keys (Web-of-Trust). In other words, a trusted key may act as a CA and mark other keys as valid, transitively.

So in order to suppress the "untrusted signature" warning on a per-key basis, you have to mark the key as a valid (as that's literally the purpose of this warning).

To mark a key as valid, you usually sign it:

gpg --lsign-key "4DCE 3C80 AAB2 CAB1 E60C  9A3C 05F4 2D66 9306 CC77"

Alternatively if you have the 'tofu' or 'tofu+pgp' trust-model active, you can also do:

gpg --tofu-policy good "4DCE 3C80 AAB2 CAB1 E60C  9A3C 05F4 2D66 9306 CC77"

Now you should see this in --list-keys or --edit-key:

pub  dsa1024/05F42D669306CC77
     created: 2011-08-31  expires: never       usage: SC  
     trust: unknown       validity: full

There is also a config option to suppress this warning for all keys; it's called trust-model always. It means GnuPG acts as if all keys were signed by a fully trusted key.

Finally, subkeys have neither trust nor validity settings, they're only containers for cryptographic parameters so they inherit this from the primary key.

Best Answer

Related Solutions

Why trust a public gpg key

How to suppress “WARNING: This key is not certified with a trusted signature!”

Related Question