gchq/CyberChef · warning · OperationError

The data does not appear to be signed.

Error message

The data does not appear to be signed.

What it means

PGPDecryptAndVerify expects an encrypted-and-signed message. After unboxing, get_data_signer() is checked; if falsy the message had no signature (encrypted only), so the operation throws because verification is its purpose. Note: thrown at line 115 inside the try, so it is re-wrapped by the catch at line 117 as 'Couldn't verify message: ...'.

Source

Thrown at src/core/operations/PGPDecryptAndVerify.mjs:115

                        }
                        if (signer.email) {
                            text += `<${signer.email}>`;
                        }
                        text += "\n";
                    }
                    text += [
                        `PGP key ID: ${km.get_pgp_short_key_id()}`,
                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString("hex")}`,
                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,
                        "----------------------------------\n"
                    ].join("\n");
                    text += unboxedLiterals.toString();
                    return text.trim();
                } else {
                    throw new OperationError("Could not identify a key manager.");
                }
            } else {
                throw new OperationError("The data does not appear to be signed.");
            }
        } catch (err) {
            throw new OperationError(`Couldn't verify message: ${err}`);
        }
    }

}

export default PGPDecryptAndVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Use 'PGP Decrypt' for encrypted-but-unsigned messages.
2. Use 'PGP Verify' for signed-only / cleartext-signed messages.
3. Re-create the message with both encryption and a signature if both are required.

if (/BEGIN PGP SIGNATURE|BEGIN PGP SIGNED MESSAGE/.test(input)) {
    // signed content - Decrypt-and-Verify or Verify is appropriate
} else if (/BEGIN PGP MESSAGE/.test(input) && !/SIGNATURE/.test(input)) {
    // likely encrypted-only - prefer PGP Decrypt
}

When it happens

Trigger: Input is an encrypted-but-unsigned PGP message; a cleartext-only message; a signed-only (non-encrypted) message that unboxed without a data signer in the expected position.

Common situations: User ran PGP Decrypt-and-Verify on a message that was only encrypted (should use PGP Decrypt); or on a cleartext-signed message (should use PGP Verify); mismatched operation to message type.

Related errors

• Could not identify a key manager.
• Couldn't verify message: ${err}
• Could not identify a key manager.
• Enter the private key of the recipient.
• Couldn't decrypt message with provided private key: ${err}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/4a2b39452168bfd8. Report an issue: GitHub.