{"record":{"id":"4a2b39452168bfd8","repo":"gchq/CyberChef","slug":"the-data-does-not-appear-to-be-signed","errorCode":null,"errorMessage":"The data does not appear to be signed.","messagePattern":"The data does not appear to be signed\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"warning","filePath":"src/core/operations/PGPDecryptAndVerify.mjs","lineNumber":115,"sourceCode":"                        }\n                        if (signer.email) {\n                            text += `<${signer.email}>`;\n                        }\n                        text += \"\\n\";\n                    }\n                    text += [\n                        `PGP key ID: ${km.get_pgp_short_key_id()}`,\n                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString(\"hex\")}`,\n                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,\n                        \"----------------------------------\\n\"\n                    ].join(\"\\n\");\n                    text += unboxedLiterals.toString();\n                    return text.trim();\n                } else {\n                    throw new OperationError(\"Could not identify a key manager.\");\n                }\n            } else {\n                throw new OperationError(\"The data does not appear to be signed.\");\n            }\n        } catch (err) {\n            throw new OperationError(`Couldn't verify message: ${err}`);\n        }\n    }\n\n}\n\nexport default PGPDecryptAndVerify;\n","sourceCodeStart":97,"sourceCodeEnd":125,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PGPDecryptAndVerify.mjs#L97-L125","documentation":"PGPDecryptAndVerify expects an encrypted-and-signed message. After unboxing, get_data_signer() is checked; if falsy the message had no signature (encrypted only), so the operation throws because verification is its purpose. Note: thrown at line 115 inside the try, so it is re-wrapped by the catch at line 117 as 'Couldn't verify message: ...'.","triggerScenarios":"Input is an encrypted-but-unsigned PGP message; a cleartext-only message; a signed-only (non-encrypted) message that unboxed without a data signer in the expected position.","commonSituations":"User ran PGP Decrypt-and-Verify on a message that was only encrypted (should use PGP Decrypt); or on a cleartext-signed message (should use PGP Verify); mismatched operation to message type.","solutions":["Use 'PGP Decrypt' for encrypted-but-unsigned messages.","Use 'PGP Verify' for signed-only / cleartext-signed messages.","Re-create the message with both encryption and a signature if both are required."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (/BEGIN PGP SIGNATURE|BEGIN PGP SIGNED MESSAGE/.test(input)) {\n    // signed content - Decrypt-and-Verify or Verify is appropriate\n} else if (/BEGIN PGP MESSAGE/.test(input) && !/SIGNATURE/.test(input)) {\n    // likely encrypted-only - prefer PGP Decrypt\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Match the operation to the message type: Decrypt (encrypted), Verify (signed), Decrypt-and-Verify (both).","Inspect the armour header to classify the message before choosing the operation.","Remember 'not signed' surfaces wrapped inside 'Couldn't verify message' here."],"tags":["pgp","kbpgp","signature","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}