Arcsign
Arcsign is a digital signature format based on Ed25519 signatures.
The arcsign tool operates on signatures in the Arcsign format.
$ echo Hello world > message
$ perl -e 'print "\0" x 32' > secret-key
$ arcsign seal -k secret-key message
$ cat message
Hello world
----- ARCSIGN EXTENSION -----
Date: 2017-09-06 20:17:09 UTC
----- ARCSIGN SIGNATURE -----
3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29
2b2149d24d00045e60b3ad9b014ce729d813b3203bc11c2fcb4e30601066c881
8c407fe8d9be64754a86a28226a438e5f6e12f32d698bf891fe30a79476cea09
$
$ arcsign unseal -K 3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29 message
$ cat message
Hello world
The arcsign tool’s seal command appends an Arcsign-format seal to a file.
An Arcsign seal consists of two parts: an extension section and a signature section.
The extension section allows additional metadata to be included. For example, a timestamp is added to prevent replay attacks. The message which is ultimately digitally signed (known as the extended message) is the concatenation of the original file contents and the extension section. The extension section is mandatory, even if it’s empty.
The signature section contains three lines of 64 hexadecimal digits each, encoding a total of 96 bytes. The first 32 bytes are the public key to use for checking the signature. The remaining 64 bytes are the cryptographic signature itself.
The unseal command verifies the signature, and if valid, removes the seal.
Specifying the public key is required, so that users can’t blithely unseal messages without at least looking at the public key.
The user may optionally choose a message pre-hash. For example, using SHA-256 can greatly improve performance when signing and verifying long messages on 32-bit systems.
$ arcsign seal -h SHA-256 -k secret-key message
$ cat message
Hello world
----- ARCSIGN EXTENSION -----
Date: 2017-09-06 20:21:44 UTC
Hash: SHA-256
----- ARCSIGN SIGNATURE -----
3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29
1fd1fdf6bf035c7f07513abb8ff6e078852e3b8770701ed3976dcf54be3f3118
63c5c99b2bdec7a862ef7de404a61ad49a9c469deb0f9565578d17d816e4d901
The only pre-hash defined by Arcsign is SHA-256, indicated by the exact string "SHA-256".
Arcsign has several important properties:
- A signed message is a single file (or other byte stream).
- An Arcsign seal can be applied to (and unambiguously recognized in) any file, regardless of contents.
- Files bearing an Arcsign seal are often still usable as is (depending on format).
- Text files may be viewed as usual. Languages such as Perl and Varyx have their respective
__END__andend.directives to terminate parsing before end-of-file. - Many binary formats (e.g. PDF, PNG, executables) work normally with a seal appended.
- Text files may be viewed as usual. Languages such as Perl and Varyx have their respective
The arcsign tool is implemented in the Varyx programming language.
It’s currently used to protect downloads of MacRelix.