gchq/CyberChef · error · OperationError

The data does not appear to be signed.

Error message

The data does not appear to be signed.

What it means

Thrown when kbpgp.unbox successfully parses the input as a PGP message but the result has no data signer — the message carries no digital signature. PGPVerify is designed for signed or clearsigned messages; an unsigned message has nothing to verify. Note: this throw is inside the surrounding try block (line 66), so it is actually caught and re-wrapped by the catch at line 104 before reaching the caller.

Source

Thrown at src/core/operations/PGPVerify.mjs:102

                        }
                        if (signer.email) {
                            text += `<${signer.email}>`;
                        }
                        text += "\n";
                    }
                    text += [
                        `PGP key ID: ${km.get_pgp_short_key_id()}`,
                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString("hex")}`,
                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,
                        "----------------------------------\n"
                    ].join("\n");
                    text += unboxedLiterals.toString();
                    return text.trim();
                } else {
                    throw new OperationError("Could not identify a key manager.");
                }
            } else {
                throw new OperationError("The data does not appear to be signed.");
            }
        } catch (err) {
            throw new OperationError(`Couldn't verify message: ${err}`);
        }
    }

}

export default PGPVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Produce the message with PGP Sign or PGP Encrypt & Sign so it includes a signature packet
2. Confirm the input begins with '-----BEGIN PGP SIGNED MESSAGE-----' or that the PGP MESSAGE block contains a signature packet
3. If the goal is decryption rather than signature verification, use PGP Decrypt instead of PGP Verify

// Pre-check: does the message look like a signed PGP message?
function looksSigned(pgpMessage) {
  const m = pgpMessage.trim();
  return m.startsWith("-----BEGIN PGP SIGNED MESSAGE-----") ||
    (m.startsWith("-----BEGIN PGP MESSAGE-----") &&
     /BEGIN PGP SIGNATURE/.test(m));
}
if (!looksSigned(input)) {
  throw new Error("Input has no PGP signature; use PGP Decrypt or a signed message.");
}

try {
  const result = await chef.pgpVerify(input, [publicKey]);
} catch (e) {
  if (/does not appear to be signed/i.test(e.message)) {
    // Re-route: try decrypt instead, or prompt user to provide a signed message
  } else {
    throw e;
  }
}

When it happens

Trigger: unboxedLiterals[0].get_data_signer() returns falsy. Occurs when the input is an encrypted-only PGP message (no signature packet), a PGP literal data packet without an accompanying signature, or a message whose signature packet was stripped or corrupted in transit.

Common situations: User encrypts a message with PGP Encrypt instead of PGP Sign or PGP Encrypt & Sign, then feeds it to PGP Verify. Or the user pastes a PGP public key block instead of a signed message. Or a clearsigned message was mangled by an email client that stripped the signature section.

Related errors

• Couldn't verify message: ${err}
• Could not identify a key manager.
• The data does not appear to be signed.
• Couldn't verify message: ${err}
• Could not identify a key manager.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/77fc122863313ccf. Report an issue: GitHub.