pgp gpg signatures and the like

PGP and GPG are, respectively:

• Pretty Good Privacy, an open standard software design and architecture for encryption using the public key / private key model. (link)
• GnuPG aka Gnu Privacy Guard, a Free Software / Open Source implementation of the PGP standard. (link)

The key to it all is key exchange. You may exchange keys in a number of ways:

• By sending it via e-mail to a 'correspondence partner'. 
• By publishing the key on a website for everyone to access.
• By uploading a key to a keyserver.

Q: Someone has sent me an email and it has an attachment 'signature.asc' so that is that all about?
A: A dot '.asc' file simply indicates that the file contains plain (ASCII) text. An ASC file

• A so-called 'inline armour' signature file '*.asc' is a static file containing a public key. 
• A PGP/MIME signature file is a bit like a checksum, it is the result of a unique calculation based on the message content and the sender's PGP key. In this case the '.asc' file contains the output of a function that uses the original document content, the sender's private key, the time etc. This works by virtue of the fact that any particular digital file has a numeric/binary representation, basically a very long number, and can therefore have math performed on it.

Q: You visit a website and where each contact person includes a seemingly random string of 40 hexadecimal characters labelled 'GPG key' otherwise known as the 'fingerprint'.
A: A fingerprint links to a downloadable version of a public key, a file such as 'somefilename.asc' containing more random  letters and numbers e.g. file contents looking somewhat like the following

----BEGIN PGP PUBLIC KEY BLOCK-----
fall34saLKU877lkdkmQENBE8e3CIBCACeeMFj0mrmp66lKg4u1yBCxZLKd6gbjOjAW6JoCmIBemOnH3yR6f4XQwpO3wcvuK1NAyV6XvjN7kg/eRwjzjKr3Ro9k+l7kk2EuTSAwEX2rudWEXdr5OCFob6ag4osic8+jajM/VAFYw3S1tPW+Jmf8FddcpXyy9yeKsDYDYbFKUPOvNwoH2qHPY4wTVi2QcsDuaHjRCqi
-----END PGP PUBLIC KEY BLOCK-----

Q: Can you suggest basic exercises to follow to learn how to use PGP signing and encryption?
A: Try attaining the following goals in order of increasing difficulty...

1. Install PGP / GPG or use webmail extension/add-on like Mailvelope (works for Chrome or Firefox only), you should then be able to verify other people's signatures and collect their public keys.
2. Generate your own key files, and store them locally initially.
3. Sign an email (doesn't encrypt the content) and send it to me (like I did above) so I can verify the signature.
4. I think signing is also a way of sharing your public key via email. After which I should be able to encrypt something intended for you.
5. Practice encrypting/decrypting
6. Publish your public key on a key server to make accessing your public key easier.

Notes:

Using Mailvelope for in browser webmail (Chrome and Firefox).

On verifying a signature file...

A detached signature file, as opposed to signatures that are encrypt-signed or clear-signed (link), is a separate file that may be used to verify the associated document, that is, both the signature.sig and the original_document.txt (or other file) are processed for verification. This can be a bit confusing for an email because it may be unclear which text file is referred to; this isn't usually an obvious problem if your pgp/gpg is integrated with your email software.

You will need to have installed GnuPG. Once installed import the signature (command line example)

$ gpg --import GPGTools-00D026C4.asc gpg: key 00D026C4: "GPGTools Team <team@gpgtools.org>" 1 new signaturegpg: Total number processed: 1gpg:         new signatures: 1gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust modelgpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1ugpg: next trustdb check due at 2018-08-19

If you run this more than once you'll see (command line example)

$ gpg --import GPGTools-00D026C4.asc gpg: key 00D026C4: "GPGTools Team <team@gpgtools.org>" not changedgpg: Total number processed: 1gpg:              unchanged: 1

Now verify the signature/file combination (command line example)

$ gpg --verify GPG_Suite-2015.09.dmg.sig GPG_Suite-2015.09.dmggpg: Signature made Wed 23 Sep 18:56:37 2015 IST using RSA key ID 0D9E43F5gpg: Good signature from "GPGTools Team <team@gpgtools.org>" [ultimate]gpg:                 aka "GPGMail Project Team (Official OpenPGP Key) <gpgmail-devel@lists.gpgmail.org>" [ultimate]gpg:                 aka "GPGTools Project Team (Official OpenPGP Key) <gpgtools-org@lists.gpgtools.org>" [ultimate]gpg:                 aka "[jpeg image of size 5871]" [ultimate]

Further reading

gnupg.org and the GPG Suite Quickstart Tutorial
kp.mit.edu
www.openoffice.org

SHA256 Wha?

What to do if you see instructions like...

 "You can find the SHA256 checksums for xxx online and you can verify the checksums signature file which has been signed using xxx's GPG key"

A SHA is a Secure Hash Algorithm (link), a one-way function of which it is difficult if not impossible to compute its inverse. I think its called an injective non-surjective function.
Anyway, online, we use SHA checksums to verify file integrity.

On Checksums...

For example: from the command line in the folder of the file you need to check thus:

$ shasum -a 256 -c vagrant_1.8.1.dmg
1bda0aed9691145a97cb5a8ae7b3492cc5e15a03  vagrant_1.8.1.dmg

Verify manually by inspection with a published copy of the checksums e.g.

vagrant_1.8.1_SHA256SUMS.txt

Or verify automatically if you have the published copy of the checksums file in the same directory as the file you need to check:

$ shasum -a 256 -c vagrant_1.8.1_SHA256SUMS.txt vagrant_1.8.1.dmg: OK 

Using the example of GPGTools and downloading the GPG Suite for Mac as of today (https://releases.gpgtools.org/GPG_Suite-2015.09.dmg). Without having GunPG installed you need to verify the downloaded file using the checksum and comparing against the published value for that file (as of today) i.e. comparing the published value to that calculated by shasum
SHA-1: f1fd930144720e70bd4c809dd36ac0573b0a7be2

$ shasum GPG_Suite-2015.09.dmg f1fd930144720e70bd4c809dd36ac0573b0a7be2  GPG_Suite-2015.09.dmg

Further reading

gnupg.org
kp.mit.edu
www.openoffice.org

(New Section) Diving into virtual machines with VirtualBox and Vagrant

1. VirtualBox
2. Vagrant