Gmail Tests PGP Signature Verification

Thursday, February 12, 2009

Gmail Tests PGP Signature Verification

Sean Leather spotted a new Gmail feature that checks if the PGP signature attached to a message is valid.

"A major benefit of public key cryptography is that it provides a method for employing digital signatures. Digital signatures enable the recipient of information to verify the authenticity of the information's origin, and also verify that the information is intact," explains PGP's documentation.

Gmail's code reveals that Google uses a Java applet to perform verification. Here are some excerpts from the code:

function zOb(a){var b=a[dd](/(-----BEGIN PGP SIGNED MESSAGE-----(.|\r?\n)*?-----END PGP SIGNATURE-----)/); ... var DOb="PGPApplet",EOb="exp/799/pgpapplet_0.jar";OZ[k].wbc=function $aRa(){var a=document[Qi](M);d(a,WNb({code:"com/google/caribou/pgp/PGPApplet.class",name:DOb,archive:EOb})); ... kOb="Click to verify PGP signature in this message.",lOb="Verify signature",RZ="vPzQab",mOb="Info",nOb="No valid PGP signature found.",oOb="Warning!",pOb="Invalid key entered.",qOb="Applet not loaded. Is Java enabled?",rOb="wrClmc",sOb="Success!",tOb="Your message was verified successfully!",uOb="Verify again",vOb="The signature was incorrect! This message may not be authentic!"

The new feature quickly vanished from Sean's account, so it's safe to assume that it's not ready to be publicly released yet. PGP signature verification is the perfect candidate to be the next Gmail Labs experiment.

Update: Expect to see this feature in Gmail Labs. Look for this image:

Labels: Gmail

25 comments ( Post a comment )

Anonymous said on February 12, 2009 6:35 PM PDT:

Signature verification is good. Email encryption would be awesome.

Phi said on February 12, 2009 6:44 PM PDT:

Sweet! I've been waiting for that. But I must agree, that encryption support would be even better. FireGPG does a pretty good job so far though.

Kaushik said on February 12, 2009 8:01 PM PDT:

Nice...Gmail has been rolling out really useful features last few weeks. Really impressed. Undoubtedly its the best email client.

Schultzter said on February 12, 2009 8:01 PM PDT:

I haven't used signatures or message encryption yet though I a public key encryption for a college course. If GMail supported it I'd definitely start using it though.

Anonymous said on February 12, 2009 8:07 PM PDT:

Interesting. I wonder which keyservers do they use, or do they use their own?

大声堂 said on February 12, 2009 9:20 PM PDT:

GMAIL is the best email i have ever used

cosbeta said on February 12, 2009 10:32 PM PDT:

Great, I love gmail!

Jens said on February 12, 2009 11:40 PM PDT:

yeah great.
i'waiting to kill my Freenigma firefox plugin finally :-)

pgp signatures are the first step... and now i'm waiting to get a full encryption including attachements! :-D

after all, i love google labs. some funny geek stuff noone needs (yay, snake!), but there are really good features! :-)

seenxu said on February 13, 2009 2:50 AM PDT:

that would be an amazing new feature.

JITENDARSINGHRATHOD said on February 13, 2009 4:04 AM PDT:

GOOD ITS MY FAVOURITE

Keith said on February 13, 2009 6:14 AM PDT:

An interesting item to keep an eye on will be how Google handles any future implementation of e-mail encryption via Gmail. Specifically, whether they encrypt the contents of auto-saved drafts, which would be the obvious weak link in a Gmail-based mail encryption scheme.

Monique said on February 13, 2009 6:28 AM PDT:

I used gmail. But only use my gmail account for bisnis only not for work or daily activity..
over all i believe with gmail.

Bertil Hatt said on February 13, 2009 7:18 AM PDT:

That would be great — and having the largest provider offer it is the best booting in you can dream of. It probably precedes a full encryption system, although that might be more information-intensive. Maybe GMail offered the "disconnected" Gears tool to dispatch this additional processing to the end-machine.

I'm not sure why I don't see it: are there any country were this might be illegal? Encryption probably is.

Alex Chitu said on February 13, 2009 7:20 AM PDT:

@Bertil:
You don't see it because it hasn't been released it yet.

Alex said on February 13, 2009 7:33 AM PDT:

FireGPG has always given me problems with GMail in the past. (Haven't used it in a while though.) This would be great, especially if they also add an ability to sign mail in GMail - maybe even encrypt/decrypt, though most users would probably assume Google was just trying to steal their keys. cf. http://xkcd.com/538/

Anonymous said on February 13, 2009 12:24 PM PDT:

This would be awesome!

Anonymous said on February 13, 2009 12:38 PM PDT:

While it is possible to use OpenPGP and Gmail with a e-mail client program, it would be excellent if the add built in signature validation in their website.
Or maybe they can make a plain text webmail option, in order to be able to paste an already encrypted inline message...

Andy Wong said on February 13, 2009 1:56 PM PDT:

It is excellent to verify pgp signature of incoming Email, as this needs only the public key of the sender. However, it is not appropriate for a web mail program to sign an Email directly, as this requires the private key which is not good to be stored on Goolge server rather your own private data store.

Having said that, I think offline mode or Browse plug-in might fill the gap.

water for gas said on February 15, 2009 3:19 PM PDT:

I really like this , It would help me a lot in what I do

Jake said on February 16, 2009 5:47 AM PDT:

I can't wait for this to be out of labs and live. Perhaps the increased visibility and automatic verification would help get people interested in PGP and email encryption!!

While it's stuck in labs, though, it will just be a toy for nerds... most of whom probably already have FireGPG installed.

leo said on February 17, 2009 5:31 AM PDT:

It is just me or gmail searches return only starred messages?

leo said on February 17, 2009 6:35 AM PDT:

it works fine now, sorry

Brian Morton said on March 20, 2009 11:12 AM PDT:

This is very exciting. I look forward to seeing this in labs.

Anonymous said on March 20, 2009 2:49 PM PDT:

I m waiting for this a long time. I hope to test it soon.

Frank said on July 8, 2009 8:55 AM PDT:

PGP signature verification is in labs? where?

What do you think?