# Signify (OpenBSD)

signify is a free and open source tool developed by OpenBSD to generate and verify signatures.
It makes use of Ed25519 and was created to enable the OpenBSD project to sign releases while not having to use GnuPG since its code complexity didn't comply with OpenBSD's standards for security and maintainability.
Contrary to OpenPGP keys, signify keys are meant to be rotated frequently and are not tied to an identity.
OpenBSD for example includes the next signing public key in each release. When version 5.6 was released, the keys for version 5.8 were generated to be included in version 5.7.

## Background

The creator of the signify utility, Ted Unangst, wrote in 2015, speaking of OpenPGP and GnuPG: "The concerns I had using an existing tool were complexity, quality, and complexity." This is in line with the project's longtime tendency to reduce complexity, and in turn, reduce the probability of vulnerabilities existing in the software, and help the user understand the software better and make more security-educated decisions. signify is integrated into the base operating system and used for verification of all releases, patches, and packages starting with OpenBSD 5.5.

## Format

signify public keys are 56 base64 characters. The first two bytes of the decoded data specifies the algorithm. The only currently supported algorithm is Ed25519 with the ID "Ed" but other algorithms can be added, for example to extend the software with post-quantum cryptography.
The key and signature formats are prepended with an untrusted comment that can be manipulated and shouldn't be relied on.

### Examples
#### Signature with embedded message
## Usage

signify has 4 possible modes:
to generate a new keypair and save the public part in a file named "pubkey" and the secret part in a file named "seckey"
to sign a file named "message" with the private key saved in "seckey" and store the signature in a file named "sigfile. Specifying -e embeds the message after the signature.
to verify a file named "message" with the public keys stored in a file named "pubkey" and the signature stored in a file called "sigfile. Specifying -e extracts the embedded message from the signature and writes it into the message file.
to verify a list of signed files with the "sigfile" being a signed list with the embedded output of the sha256 command.

## Usage

Apart from the obvious usage in OpenBSD, other projects also use signify:
* GrapheneOS
* OpenWRT (slightly modified variant called usign)
In contrast, other Free Software operating systems and security-focused software tend to use OpenPGP for release verification, and as of 2024 continue to do so, including: Debian, a prominent operating system that's also used as a base for other operating systems, including Ubuntu; Kali Linux, a specialized operating system for penetration testing, security research, digital forensics, and reverse engineering; Qubes OS, a security-focused operating system; Tor Browser, an anonymous Web browser; SecureDrop, a software package for journalists and whistleblowers to exchange information securely and anonymously over the Internet; and VeraCrypt, a software program for on-the-fly encryption and full disk encryption.