Verifying a Signed Export - Revision history

Dweuthen at 13:00, 23 October 2017

2017-10-23T13:00:47Z

Bmeyn at 09:34, 18 October 2017

2017-10-18T09:34:33Z

Dweuthen at 11:44, 7 September 2017

2017-09-07T11:44:34Z

Dweuthen at 11:33, 7 September 2017

2017-09-07T11:33:54Z

Dweuthen at 11:30, 7 September 2017

2017-09-07T11:30:17Z

Dweuthen: Created page with "It is possible to digitally sign an export of archived messages to the file system when as EML or MSG format is used. This helps to ensure integrity of each exported email whi..."

2017-09-07T09:13:10Z

Created page with "It is possible to digitally sign an export of archived messages to the file system when as EML or MSG format is used. This helps to ensure integrity of each exported email whi..."

New page

It is possible to digitally sign an export of archived messages to the file system when as EML or MSG format is used. This helps to ensure integrity of each exported email while it resides outside of the archive. A SHA256 hash of the public key, that can be used to verify the signatures, is stored in the archive's temper proof audit log.

In order to verify the integrity of a signed export, the OpenSSL executable may be used. This needs to be installed on the computer where verification takes place.

== Create Hash of Public Key ==
The following command generates a SHA256 hash of the public key in order to verify it against the hash recorded in MailStore's Audit Log.

<source lang="bash" smart-tabs="true" toolbar="false" gutter="false">
openssl dgst -sha256 -hex publickey.pem
</source>

== Verify All Emails ==
The following one-liners can be used to verify a signed export including all subdirectories.

=== Linux or MacOS ===
<source lang="bash" smart-tabs="true" toolbar="false" gutter="false">
find . -name '*.eml' -exec openssl dgst -sha256 -verify publickey.pem -signature \{}.sig \{} \;
</source>

=== Windows (PowerShell) ===
<source lang="powershell" smart-tabs="true" toolbar="false" gutter="false">
ls -r *.eml | ForEach-Object { $file_sig = ($_.FullName) + '.sig'; $file_eml = $_.FullName; openssl.exe dgst -sha256 -verify publickey.pem -signature "$file_sig" "$file_eml" }
</source>

@@ Line 1: / Line 1: @@
 It is possible to digitally sign an export of archived messages to the file system if the EML or MSG format is used. This helps to ensure the integrity of each exported email while it resides outside of the archive. A SHA256 hash of the public key that can be used to verify the signatures is stored in the archive's tamper proof audit log.
-To verify the integrity of a signed export the use of OpenSSL is recommended. It needs to be installed on the computer where verification takes place in order to run the following commands.
+== Prerequisites ==
 == Create Hash of Public Key ==
@@ Line 20: / Line 33: @@
 === Windows (PowerShell) ===
 <source lang="powershell" smart-tabs="true" toolbar="false" gutter="false">
-   ls -r *.eml | ForEach-Object { $file_sig = ($_.FullName) + '.sig';  $file_eml = $_.FullName; openssl.exe dgst -sha256 -verify publickey.pem -signature  "$file_sig" "$file_eml" }
+   ls -r *.eml | ForEach-Object { $file_sig = ($_.FullName) + '.sig';  $file_eml = $_.FullName; Write-Host -NoNewLine ($_.Basename) `t": " ; openssl.exe dgst -sha256 -verify publickey.pem -signature  "$file_sig" "$file_eml" }
 </source>
 [[de:Verifizieren_eines_signierten_Exports]]
 [[en:Verifying_a_Signed_Export]]

@@ Line 1: / Line 1: @@
-It is possible to digitally sign an export of archived messages to the file system when as EML or MSG format is used. This helps to ensure integrity of each exported email while it resides outside of the archive. A SHA256 hash of the public key, that can be used to verify the signatures, is stored in the archive's temper proof audit log.
+It is possible to digitally sign an export of archived messages to the file system if the EML or MSG format is used. This helps to ensure the integrity of each exported email while it resides outside of the archive. A SHA256 hash of the public key that can be used to verify the signatures is stored in the archive's tamper proof audit log.
-To verify the integrity of a signed export, the use of OpenSSL is recommended. This needs to be installed on the computer where verification takes place in order to run the following commands.
+To verify the integrity of a signed export the use of OpenSSL is recommended. It needs to be installed on the computer where verification takes place in order to run the following commands.
 == Create Hash of Public Key ==

← Older revision		Revision as of 11:33, 7 September 2017
Line 22:		Line 22:
	ls -r *.eml \| ForEach-Object { $file_sig = ($_.FullName) + '.sig'; $file_eml = $_.FullName; openssl.exe dgst -sha256 -verify publickey.pem -signature "$file_sig" "$file_eml" }		ls -r *.eml \| ForEach-Object { $file_sig = ($_.FullName) + '.sig'; $file_eml = $_.FullName; openssl.exe dgst -sha256 -verify publickey.pem -signature "$file_sig" "$file_eml" }
	</source>		</source>
		+
		+	[[de:Verifizieren_eines_signierten_Exports]]
		+	[[en:Verifying_a_Signed_Export]]

@@ Line 11: / Line 11: @@
 == Verify All Emails ==
-The following one-liners can be used to verify a signed export including all subdirectories.
+The following one-liners can be used to verify a signed export including all subdirectories. The commands are to be executed inside the export's target directory.
 === Linux or MacOS ===