Topic: Verifying the PGP Signature to electrum? (Read 291 times)

If you need to use Ledger Live on a smartphone, make sure you download the software from a link on the official website. In case of Ledger, it's https://www.ledger.com/ledger-live. Never search for any apps from the App Store or Play Store because there have been many instances of fake phishing apps being posted there. Their whole purpose is to steal your seed and gain access to your coins.

Thank you so much for this potentially helpful information. I will keep it in mind for the future in case I ever need to use it for a mobile device.

I know I'm a little late to the party here, but that's not strictly true.

I have the Ledger Live app installed on my Android device (Samsung Galaxy S20 FE), and can connect my Ledger Nano S to it using a "USB C to USB A adapter" like this:


and then using a standard USB-A to Micro USB cable to connect the Nano S. (I don't have a USB-C to Micro USB cable to try)


It's fully functional, if somewhat of a janky solution


NOTE: There is a Ledger Live app on the Apple store as well, but I don't have a suitable iOS device (nor the appropriate adapters) to try and test connecting the Nano S to iOS devices.

Skip the steps from the start to the importation and certification of Electrum developers' public keys.
You should go straight to verify Electrum with the signature (.asc) file, of course download the new signature file that's released with that version.

I keep forgetting exactly how I verified Electrum each time I'm required to do it again for a new update. I was hoping someone could tell me what steps of the PGP verification process do NOT need to be repeated and what steps I do need to repeat to verify it?

Thanks for the advice @o_e_l_e_o I will go check it out.

Both the official CLI/GUI wallet and Feather wallet work with hardware devices. The Monero subreddit is a good resource for Monero info: https://www.reddit.com/r/Monero/

Ledger Nano S devices are not compatible with phones.

You can use Electrum to interact with your Ledger device by following the guide here: https://support.ledger.com/hc/en-us/articles/115005161925-Set-up-and-use-Electrum

Once you've created your wallet, it's a simple as taking the next receiving address from Electrum and sending coins which you have bought to this address.

Okay I'll do that thanks and that's interesting. Ok and I'm hoping this is on topic... how exactly do I use a Bitcoin ATM alongside and Electrum Wallet? I use a hardware wallet too btw.

If it's about Monero, I doubt people here in Electrum board would be willing to give you answers since it's off-topic.
If you want, you can post a new topic in 'Altcoins' or 'Wallet Software' board regarding that matter.

As for sending or receiving cryptocurrencies in Android or iOS in general, there are a lot of SPV or centralized wallets out there that works in either platform.

Ok thank you so much I managed to do it thanks to that one video and your post, and I'd like to find a good Monero Wallet to use with my Hardware Ledger Nano S on my computer as I assume to date it's not possible to send or receive cryptocurrency via a iphone or android device?

I can confirm I hold the following keys locally:

Emzy - 0x9EDAFF80E080659604F4A76B2EBB056FD847F8A7, with subkey 0x637DB1E23370F84AFF88CCE03152347D07DA627C

SomberNight - 0x0EEDCFD5CAFB459067349B23CA9EEEC43DF911DC

ThomasV - 0x6694D8DE7BE8EE5631BED9502BD5824B7F9470E6

These three keys match the keys which have signed your Electrum download, so you are safe to install. As nc50lc says, if you want all three to verify fully you'll need to import and verify Emzy and SomberNight's keys as well.

That video if for the older Electrum binaries that are signed by ThomasV alone.
The latest now have 3 signatures. Namely; by ThomasV, SomberNight and Stephan Oste (Emzy).

The result that you get is "good enough" for having one valid signature and certified certificate out of the three.
But if you really want a "green result" you should redo the steps to "import" and "certify" the other two developer's PGP key.
You can find their keys here: https://github.com/spesmilo/electrum/tree/master/pubkeys

I think I did it but it looks different from the youtube video tutorial I watched here:https://www.youtube.com/watch?v=Y0zgZ4M1Bro



This is what it shows me (it had no green coloured background like in the video):


 "Verified ‘electrum-4.4.6-setup.exe’ with ‘electrum-4.4.6-setup.exe.asc’: 3 valid signatures."


                 Signature created on August 20, 2023 7:18:16 PM
With unavailable certificate:
ID: 0x637DB1E23370F84AFF88CCE03152347D07DA627C
You can search the certificate on a keyserver or import it from a file.

Signature created on August 17, 2023 4:59:29 PM
With unavailable certificate:
ID: 0x0EEDCFD5CAFB459067349B23CA9EEEC43DF911DC
You can search the certificate on a keyserver or import it from a file.

Signature created on August 17, 2023 3:09:34 PM
With certificate:
Thomas Voegtlin (https://electrum.org) <[email protected]> (2BD5 824B 7F94 70E6)
The signature is valid and the certificate's validity is fully trusted."

That would be for your own PGP/GPG key pair, you can leave the email field empty if you want.
For verifying Electrum signatures, it doesn't matter if you've set an email or not.

It's never been a requirement but optional for the users' own safety.

AFAIK, there's no Electrum in the 'App Store', if there's one, it isn't official.
For Electrum downloaded from Android's PlayStore, you should check if it's uploaded by "Electrum Technologies GmbH" since you can't verify an already installed app.
If you want to verify, download the ".apk" and its signature file from electrum.org to verify it in your PC before installing to your device.

Thanks a lot for the new guide ^   but my 1st question now (among many others) is does it matter what name and email address I use at step 1? I don't know where my "key" is located where I can back it up... is that step really necessary? I DON'T KNOW WHAT I'M READING trying to follow that tutorial!?

Also it seems i forgot my passphrase for my key do I just start over even though it says not to delete it?

OR I NEED a step-by-walthrough an up-to-date one if possible.... I'm using version 4.2.2 do I really need to update I know its old af but?



OFF-TOPIC: Is it possible to get Electrum on an iphone?

That is the PGP key of ThomasV, the lead dev of Electrum. You should import it in to Kleoparta by clicking on "Notepad", pasting it in, and then clicking on "Import Notepad".

You are almost there. You have confirmed that the Electrum file you have downloaded has been signed by three sets of keys. It is telling you the signatures cannot be verified because you have not yet told Kleopatra that you trust those three sets of keys as belonging to the Electrum devs.

---

Since you already have Kleopatra installed, the next step is to import the PGP keys of the three Electrum devs which sign the releases. As above, go to "Notepad", paste in the first key, and then click on "Import Notepad". Do this for each of three keys you will find here:
https://github.com/spesmilo/electrum/blob/master/pubkeys/ThomasV.asc
https://github.com/spesmilo/electrum/blob/master/pubkeys/Emzy.asc
https://github.com/spesmilo/electrum/blob/master/pubkeys/sombernight_releasekey.asc

Once you've done that, you should repeat what you did above to open the .asc file with Kleopatra. It should now show you that the three signatures are verified and you are safe to install.

Three guides for Windows, Linux, Android.
[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message - Fingerprint
[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message (Linux Only)
[Android Tutorial] PGP Signature - Encrypt/Decrypt message

Thanks that's most helpful guide posted so far, but in that video I'm sent to a file to download when I click signatures next to electrum download file but it doesn't bring to a webapge to copy and paste the text like the youtube video shows it just a file that when I open it now with GPG4Win/Kleopatra installed it brings up a bunch of options 1st one stating I got 3 signatures that cannot be verified?

I'm stuck now at the Command Prompt part of the video and I thought it was because I installed the files onto my desktop instead of the downloads folders so I typed in that location instead but it just says it won't work? Wtf am I doing wrong damnit! This whole entire proccess is sooo discouraging and I felt fairly knowledgeable and confident regarding this until now.





OMG I'm  beginning to remember why I gave up on trying to accomplish this seemingly mandatory task FFS!

BTW I'm using Windows 10 and I dd NOT verify the hash values of GPG4Win before I downloaded and installed it so I'm assuming it won't make a difference if I verify it now... even if it were worse case scenario?

Um thank you but now I'm stuck at step 3 due to the links for files I need leading me to a youtube video and the other leading me to this:


"-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBE34z9wBEACT31iv9i8Jx/6MhywWmytSGWojS7aJwGiH/wlHQcjeleGnW8HF
Z8R73ICgvpcWM2mfx0R/YIzRIbbT+E2PJ+iTw0BTGU7irRKrdLXReH130K3bDg05
+DaYFf0qY/t/e4WDXRVnr8L28hRQ4/9SnvgNcUBzd0IDOUiicZvhkIm6TikL+xSr
5Gcn/PaJFS1VpbWklXaLfvci9l4fINL3vMyLiV/75b1laSP5LPEvbfd7W9T6HeCX
63epTHmGBmB4ycGqkwOgq6NxxaLHxRWlfylRXRWpI/9B66x8vOUd70jjjyqG+mhQ
+1+qfydeSW3R6Dr2vzDyDrBXbdVMTL2VFXqNG03FYcv191H7zJgPlJGyaO4IZxj+
+O8LaoJuFqAr8/+NX4K4UfWPvcrJ2i+eUkbkDJHo4GQK712/DtSLAA+YGeIF9HAn
zKvaMkZDMwY8z3gBSE/jMV2IcONvpUUOFPQgTmCvlJZAFTPeLTDv+HX8GfhmjAJY
T5rTcvyPEkoq9fWhQiFp5HRpYrD36yLVrpznh2Mx7B1Iy8Rq/7avadwVn87C6scJ
ouPu+0PF3IeVmYfCScbfxtx1FaEczm8wGBlaB/jkDEhx0RR8PYKKTIEM7T2LH2p6
s/+Ei4V7mqkcveF/DPnScMPBprJwuoGNFdx2qKmgCKLycWlSnwec+hdyTwARAQAB
tBlUaG9tYXNWIDx0aG9tYXN2MUBnbXguZGU+iQI4BBMBAgAiBQJN+M/cAhsDBgsJ
CAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAr1YJLf5Rw5hlhD/9T4I/sBCleS9nH
njTJqcOnG28c9C3CRYIizjEui/pKmXz9fB1N9QrCaruPUQx2UacDVCl6dKxac+7s
s3/a6lsjaRn0/2OM/sCVLScyxNPNPQs2b6jkodSNPIM8zv51g+flhwtfrO6h6B4j
IhZgSjFdvqtZd5jaly9rA0uMX045CC4K6HGnq8n4F2p31z0L0LaHBf5EcsCM0MMp
QVkY0aUrNg9uVMGXBHn3osHnOtQaODqcIbpa/OG+Tlt6pVOiDJ7i8TkpQKT7sOaM
VdL//TEoDIOC7qVCN82q2q/gtiBXbziaERVs/eU0O52aX5qUhXu3VIjXTp/riRim
R/f9BPB1dgDZbF2aPZ/rJm26v82ft7gP1Sf52E9MrAaZATTfI0/TUHXeBzN93EA9
xb6/ENAMTX74u+NjlynWPD+hl64eBzJ2ionZF1bJFTgBkMfRYnhllvleCjcq9YfX
md5HKCwtxfygBIujUQSwyUzn0f5DbVCJ7/B19bKdvHGSSBgBEjxqXWQskm2wc0In
ww63goZAGDQliKhIT8xnwOBbLkqSobq4tD9zpQyxvMA2rhy7/gfFRp7TTak7MZHf
lTJ37S5LvcWHm/ccWUZDUN7akoEDc+m6jX3uIEPMD3PQvcHhWv0amco3zDr1qb/+
rXM7TJKd7DPX0E2dRzKu6aYRMTbklbQhVGhvbWFzIFZvZWd0bGluIDx0aG9tYXN2
MUBnbXguZGU+iQI4BBMBAgAiBQJTQDaRAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIe
AQIXgAAKCRAr1YJLf5Rw5hOBD/9o/NqHLvjhrCfy6/SblSC/udV9ujFnvhZZZprb
r8Oe6GdMwfw+ktZd2nYb09KjxXYmGoZeZKmvCb0LoMKSVWgisH1rgzDzI6UzFL4b
pV2+PqCSiWaekfnBm+oHbGgJCuAXebGXjVL8JsvhAl0HQZzTA1RX0u8TEAHOxOI5
l+mXSN+cwVZuDMpt5v+JDyPGHM/KqaXCw1WJY50mqlan6/15XHilmvY/CaxmbXNH
ZOXucmPxyCTeiQTqyhHsIBb4RxWYCaUXv9+svriotv2HZpQ110NN09ml1K1kDlNL
Zh3jNqMsbImFArbN8GikjqhRBV3K77Np4lccnsBPllQMqqQULG7UshcQTatkmTMb
j2TQ0oQWEZt0uJmnmxgz18ijs6m2fJZhlH0QYVYOwUvK6GfAFluHwOZHIXonv8Ck
uTW+P90lOB/9ZnREZeYb2wlvV6fCTMHxptIbT31kbLTzu4KEI6+ShQXT+YAKiC5S
JC9heheaeApH3wcLiZJcCKYv6ubY+3Uf/EoXcqWywwpS/nWkSpMSYjq+V9xCcGHI
MZ4vZkiZ6OS5Mu739rgGfP7Yi3pqUYLIpUa5QiNOMEhPtWbj/oH5ldaZowwgZ4MK
2Mzxex8IhFppPtZgqJfu9NZQLICpxcd2hUe3XWvB+jcvboZ1p7RO7ax3Vo9zy1fy
YEFML7Q9VGhvbWFzIFZvZWd0bGluIChodHRwczovL2VsZWN0cnVtLm9yZykgPHRo
b21hc3ZAZWxlY3RydW0ub3JnPokCOAQTAQIAIgUCVMYFygIbAwYLCQgHAwIGFQgC
CQoLBBYCAwECHgECF4AACgkQK9WCS3+UcOZ7BQ//VJuRmM7kQd5DcJS76BKpMtKt
gUNV3hi2h8kNGtkIeKhpeiK+PeweFJCb0nQDiEYsg5Xd/l5ZwN34cqlhgaQ8uWBY
rmNnSYGECLrxejx6WTWHp2AtD9BXrj73HEox2abC0Bdky39aCTyuRhSzbFnV2unh
L7IarKqr5bat6ywFZWsOcaisEjWXlTSD/hYqnkRX8vnBZRnRgHyi1yOvHsXGFB3x
O+P7JUb4E7BVzVRDJzMgcBhY5vTZ4Mnc8eIplNVI1TaF2hmhmnezvRF6XNYV1Ew9
t2/HE85+DqIBikUWYPTTxJiWUOwxXP9dVOEmNTcAgVThvMN7W+WoF7//qcNKmbPI
DyGU5xb/MLNrM+MWfavtkHNqcY0+cFf27z4mOxd2eEMDVxN/Fhq0HipugMEawaZ0
G9xsF/rZBzKgpu7+SvqRqxUn36vNz59vDlBYEXSng6nJobUdNb6iHo/rpZ6ZYHKx
mzrK5ROpmKs6zpPTOn8Hw29jxx07auzEIVEa8hzZaiqTfwI9yBwzhFQwNxmNaKRE
adxosvU1VyTvaEVmMmTx227MF1qhwq9yrSXtmKZJGiHRzyL4B4vAGrf9uK9GwzS2
TlyksRdjapw6Cqp8sUB2PUzHqYNWs0wSsZuxwVt6JSD4N8vpYTTF00LONKe2oLhj
GNxpH+BV3SqMHXQl9Ki5Ag0ETfjP3AEQAL5LYJiX5S4PG891TMihejh5KVgc36/R
zgWYJkE26K855t+WdAa6spHKR1RmpTTsnaTXaC/bNxJZq+0vi9GKlw94twEueu0v
Cniinpy6AFeydveCi+qdr5XQ4hx1DY11kntGBL2wMOtrZ4oAeFnntHYcAMYaMBY5
p8gd3WVR2dgIvpOcezQBLwhoMHnN6A+JEQ27ZHcolwDO9ic+t4YAtl552DP1xKbc
T4D1JD0J6W6FbUJElOXReSjNGCuSLZZTsCzMg0P6RHwWUKtDvRKrK/M3Nh/L2EsW
5mAQnYps6a+hyVkVd9kLsogtHPE4xv33pzbDB5Yj+2zqdjYUqO/ODfkP+HjNRvyj
uHL6W3bjU6FnuJQXX4llskls4hlKDPawa3cuWnsdafouAZOxWwBlGysRZ7BaHOFE
TOlAeUN1EYfFrckcfkYzTX7NDA0S99aX730z/c9XrnqM52OO9LrSFRnYZ+K3M8z2
FFvo9/ZtqqTDH0/oH+ay0CwtowSovZUoljAQ8zmmi8CtPDFHg4srae8YxW4fetn7
QtP6rOVRwQCyP12LztC7oYGOectU5G9GkVDubNW48Vuex0/upP9RORjKN8atBroS
cmomR5hShxmgdJBy4I/TDkVFbZq/hRPSTAHgnciEC67TYhszzXP3nTn5/Ah0wCGC
d3HfiNX6G7MdABEBAAGJAh8EGAECAAkFAk34z9wCGwwACgkQK9WCS3+UcOaJRA//
dLHRBjeAkNbRsY5GNTWUZzXr3VC5vNqpwpP9rK4QTAmpl3iU5F+wsgMG78iS2XOV
+ijZA8KvishletQJoNMxS1PU4sA4Y34hYb61ptHs+PmwNpcdgjAX+mCh9xQ0816G
yIaXtxtxacJJW3K07fqKIkJjISPOyTLSd+wl1LtRE2fA67pMmpMHG8t+RPq1dp/e
3qp6L7jc6X3U+bn2m7u2cgEVbuAnSaKGoMSMnsd71Ltf1b6/DwvZz/HBttEgcgSm
PleHUVyBD4LDrcjTDK7zdEMw7b/cPBnu6CmTcogFEqvB4n9Yodo+4ij7AndUTz4J
j1p8vFlnHvhRg82MDfGUPJ+ujBjbYXROs+WAmaCQ8TgjZ3dAFNFrOqAbYu6QlY2x
fu7vj+ruc6ArdmBrOlsJFmNsxFRJfgdUug5JFIUN77GbjisHjWem8cY3szuyEke8
H2pi803CAuVtkaoNmNDHsEBieft34Zo0V+A/q2wkix3S9vyRjOKqhGrW30qxnV6Z
FexueWuO3qOQ0ZU5/TIH0kft2n45/RexeBq/Ip52zE1vEvTkQmBCfCGZmqTu+9Ro
8qsjecxVNxyVPlwhlimryiQ+dPaJYaOSfiwEEMh2MyV5c6t6qN9n6jFdiCLOlmmH
ZFA8xDodsofQEmlv+I/xyEZ7na6nxbpZVuPC3B0JFtY=
=sUYl
-----END PGP PUBLIC KEY BLOCK-----"







 But idk if this ^ is what I need let alone useful to me in anyway at all to copy and paste it somewheere?

You mean this guide: [GUIDE] How to Safely Download and Verify Electrum [Guide]?
It's on the correct order but it has instructions for three different operating systems, one introductory introductions, then the complete procedure per OS.
So if you scroll-down too much without reading the headers, you might see another "step1" for another OS.

You can refer to the guide's clickable "Table of Contents" and only follow the instructions for your machine's operating system.

What operating system are you using?
For Windows, this explanation is brief ---> https://www.youtube.com/watch?v=TzOHLL_dKCM
For Linux there is one code you can use which is explained  ---> https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Follow the instructions and take a screenshot if nothing works (make sure to hide sensitive information)

To honest in a blunt way. It's only overwhelming it's confusing AF. It seems like the instructions are not in order I guess?

The guide is pointing to your GPG/PGP private key, it's basically the "secret" part of the keypair that you've created which consists of a private and public key.
It has no relation to Bitcoin's private key.
Since you now have a keypair, you can now proceed to import Electrum developers' public keys.

If the provided tutorials are overwhelming, try this simple one: bitcoinelectrum.com/how-to-verify-your-electrum-download/

I'm new to cryptocurrency in general but...

I downloaded the signature file next to the electrum download which I'm not sure about that if those are the right files in right order. I made a keypair but it mentions a private key?  Do I download the electrum file before or after verifying the PGP signature or do I only download the file next to it that says "signature" on the oiffical website?
 
"If you already have a private key that can be used to certify other people's keys, you can import it at this time."




I've needed to learn PGP encryption for anything in my life until now so any help is greatly appreciated more than one can realize lol.

Yeah, removing corrupted programs is a pain, but it is nothing compared to the nightmare of losing all your coins for good.  If that messed up software wiped out your wallet, leaving you with zero balance - now that would really suck! Thats like the worst case scenario when it comes to crypto fails.  Utter agony.  So while removing crappy corrupted stuff is annoying, be grateful it is not as bad as it could be.

You are correct. PGP signature ensure the authenticity of a file or a message. If I send you a signed message, you can verify it to be sure it was me who sent it.
However, even if you download a fake app and connect your hw device to it, It won't be able to access your coins. It can change some data like the recipient address and the sent amount but it still need your confirmation to sign the transaction. All the information will be displayed on your hw device screen before you click on the confirmation button to sign the transaction and approve it.

electrum PGP Signature verification ensures that you have not downloaded electrum from an unknown source, which is often a scam, which means that once you install the application, connect the hardware wallet and click on the message signature button, they may be able to access all of your coins, modify the balance before signing, and show false data.
as we can know how this scam app works, but it will inevitably lead to you losing all or part of your balance, so try to verify the signature to ensure that you have downloaded the correct electrum.

Yes, by design, your private keys are contained in your Ledger Nano S.
The created Electrum wallet with it only contains its "extended public key" which can only derive public keys to addresses.
Worst case, your privacy is at risk, not that using an SPV wallet like Eletrum is private in the first place.

However, an unverified fake Electrum app may trick you to send to a different address or anything that'll change the transaction's data before you sign it with your hardware wallet.
That's still dangerous if you do not pay attention during verification of the address and amount shown in your Ledger's screen.

So try to verify Electrum even if you find it hard to accomplish.
If you came across any errors, report it here so we can tell you what went wrong during the process.

What OS did you use to install Electrum?

Make sure you download it from the official site: https://electrum.org/#download; https://download.electrum.org
and also check whether the PGP signature matches the public key or fingerprint of one of the developers, for example, ThomasV:
https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6

Below is an example of verifying a PGP signature from an Electrum wallet using Windows OS:

- Download Primary key fingerprint ThomasV.
- Go to the directory where the Electrum and signature files have been downloaded
- Verification

The following is an example of a screenshot:


For MacOS, there are only slight differences; you can see the following example:

Which one of the above mentioned tutorials did you follow and what error message are you getting so we can help you? Creating your own key-pair isn't supposed to be that hard but it depends on the tool you are using.

Technically, even if you download a fake copy of Electrum it won't be able to steal your coins from your hardware wallet without your permission. It doesn't have access to your wallet's private keys to sign transactions.

Okay it says I need to make my own PGP public key but doesn't explain how exactly so maybe I did that wrong idk? Out of curiosity of I use a hardware wallet like ledger nano s via electrum desktop app that is has not had PGP verification and worse case scenario no one can technically access my bitcoin that's on my hardware wallet. It'd simply be the pain in the ass of removing the software that's corrupted on the computer it was used on if I'm not mistaken?

Go though this guide:

[GUIDE] How to Safely Download and Verify Electrum [Guide]

Or this:

I'm not sure, but I don't think you can verify PGP signatures with Electrum. You'll need software like GnuPG or VeraCrypt to do this.

The process is relatively simple:


https://www.linuxbabe.com/security/verify-pgp-signature-software-downloads-linux

I haven't verified a PGP signature in a long time so I guess I'm doing something wrong. But I was hoping I can get a fresh view on how I can go about it or is the official walkthrough the best and easiest way to go about and I should just re-read and attempt it over again to figure out what I did wrong?