Table of Contents

Choose a verification method Before you start Install or find GPG Windows macOS Linux Android Inspect the Shift Crypto signing key Import the verified signing key Verify the downloaded BitBoxApp file Check the result If verification does not succeed If GPG cannot find or open a file If GPG reports “No public key” If GPG reports “BAD signature” If the primary fingerprint is different If verification still fails Alternative: AI-assisted signature verification

Signature verification lets you check whether Shift Crypto signed the exact BitBoxApp installation file you downloaded and whether the file has remained unchanged since signing. Perform this check before opening, extracting, or installing the file. Verification succeeds only when GPG reports a good signature for that file and the signing key’s complete primary fingerprint matches the official fingerprint shown in this article.

Choose a verification method

Method What it provides When to use it
Manual GPG verification The highest assurance because the verification runs locally and you check the complete signing-key fingerprint yourself. Recommended whenever you can use a command line.
AI-assisted verification An easier workflow, but with lower assurance because you must also trust the AI provider, its execution environment, and its report. Use only when local command-line verification is a barrier and the model can process the complete file.
SHA-256 checksum comparison Confirms that your file matches the file published for the release. It does not independently confirm who signed it. Use when you only need to compare the downloaded file with the published checksum.

Before you start

You do not need to connect your BitBox or provide any wallet information. Signature verification never requires recovery words, a wallet backup, a password, a passphrase, a private key, a PIN, or an authentication code.

For manual verification, you need:

  • the BitBoxApp installation file for your operating system;
  • the matching .asc signature file from the same release;
  • the Shift Crypto public signing-key file; and
  • GnuPG, which provides the gpg command.
  1. Open the official BitBoxApp releases page on GitHub.
  2. Open the release that matches the version in your downloaded BitBoxApp filename.
  3. Download the installation file for your operating system. Do not select GitHub’s automatically generated Source code (zip) or Source code (tar.gz) archives.
  4. Download the .asc file with exactly the same base filename.
  5. Download the Shift Crypto public signing-key file.
  6. Keep all three files unchanged in the same folder.
Platform Installation file Matching signature
Windows .exe The same filename followed by .asc
macOS .dmg The same filename followed by .asc
Linux .AppImage, .deb, or .rpm The same filename followed by .asc
Android .apk The same filename followed by .asc

Verify the exact file you intend to install. Do not verify one copy and then install another copy from a different folder or source.

Install or find GPG

Follow the instructions for the device on which you will perform the verification.

Windows

  1. Download Gpg4win from the official Gpg4win website.
  2. Install Gpg4win.
  3. Open Command Prompt or PowerShell.
  4. Run gpg --version.

Continue when the installed GPG version appears.

macOS

If Homebrew is already installed:

  1. Open Terminal.
  2. Run brew install gnupg.
  3. Run gpg --version.

If you do not use Homebrew:

  1. Open the official GnuPG download page.
  2. Select one of the listed macOS installers.
  3. Follow the installer’s instructions.
  4. Open Terminal.
  5. Run gpg --version.

Continue when the installed GPG version appears.

Linux

  1. Open a terminal.
  2. Run gpg --version.

If the installed GPG version appears, continue to the next section. If the command is unavailable, use the command for your distribution:

  • Debian, Ubuntu, or Linux Mint: sudo apt install gnupg
  • Fedora: sudo dnf install gnupg2

For another distribution, install GnuPG through its official package manager. Run gpg --version again after installation.

Android

The recommended option is to verify the APK on a Windows, macOS, or Linux computer. Download the APK and its matching .apk.asc file, then follow the instructions for that computer above. You are verifying the APK file itself; it does not need to be installed on the computer.

You can also verify the APK directly on Android with Termux. This advanced route requires Android 7 or later. If a command or storage path differs on your device, use a Windows, macOS, or Linux computer instead.

  1. Save the APK in Android’s Downloads folder.
  2. Save its matching .apk.asc file in the same folder.
  3. Save the Shift Crypto public signing-key file in the same folder.
  4. Install Termux from F-Droid.
  5. Open Termux.
  6. Run termux-setup-storage.
  7. Allow file access when Android asks.
  8. Run pkg update -y.
  9. Run pkg install gnupg -y.
  10. Run cd ~/storage/downloads.
  11. Run gpg --version.

Continue when Termux displays the installed GPG version. If Termux cannot access the Downloads folder, perform the verification on a computer instead.

How to insert a file path

When a step tells you to insert a file path, do not press Enter until the instructions say so.

  • Windows: In File Explorer, right-click the file, select Copy as path, and paste it into Command Prompt or PowerShell. Hold Shift while right-clicking if Copy as path is not shown.
  • macOS: Drag the file from Finder into Terminal.
  • Linux: Drag the file from your file manager into the terminal. If dragging is unavailable, enter the complete path.
  • Android: Type the filename in Termux. You can type its first characters and press Tab to complete it.
 

Inspect the Shift Crypto signing key

Inspect the public key before importing it:

  1. Type gpg --show-keys --fingerprint followed by one space. Do not press Enter yet.
  2. Insert the path to shiftcryptosec-509249B068D215AE.gpg.asc.
  3. Press Enter.
  4. Confirm that the primary key identity is ShiftCrypto Security <security@shiftcrypto.ch>.
  5. Compare the complete primary fingerprint with the fingerprint below.
DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

The complete fingerprint must match

Do not import or trust the key when the complete primary fingerprint differs. A familiar name, email address, short key ID, or an AI model’s reassurance is not a substitute for the complete fingerprint.

 

Import the verified signing key

  1. Type gpg --import followed by one space. Do not press Enter yet.
  2. Insert the path to shiftcryptosec-509249B068D215AE.gpg.asc.
  3. Press Enter.

GPG should report that the ShiftCrypto Security public key was imported or was already present.

Verify the downloaded BitBoxApp file

  1. Type gpg --verify followed by one space. Do not press Enter yet.
  2. Insert the path to the matching .asc signature file.
  3. Type one space.
  4. Insert the path to the BitBoxApp installation file.
  5. Press Enter.

The completed command follows this pattern:

gpg --verify "PATH-TO-SIGNATURE-FILE.asc" "PATH-TO-INSTALLATION-FILE"

Keep the order shown above: the .asc signature comes first, followed by the exact installation file you intend to use.

Check the result

When verification succeeds, GPG reports a good signature from ShiftCrypto Security. The surrounding wording and trust label may vary with your GnuPG version and language.

gpg: Good signature from "ShiftCrypto Security <security@shiftcrypto.ch>"

Confirm again that the signing key used for the verification has this complete primary fingerprint:

DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

If the verification output does not show the complete fingerprint, run the following command and compare it again:

gpg --fingerprint DD09E41309750EBFAE0DEF63509249B068D215AE

GPG may warn that the key is not certified with a trusted signature. This describes your local GPG trust database. It does not invalidate a good cryptographic signature, but it also does not replace the complete fingerprint comparison.

Signature verified

Verification is complete only when GPG reports a good signature for the exact installation file and the complete primary fingerprint matches the official Shift Crypto signing-key fingerprint. You may then continue with installation, subject to the normal security checks of your operating system.

 

The following historical screenshots show where the good-signature message and primary fingerprint appear. Use them only as visual orientation; their BitBoxApp versions, filenames, and commands are outdated.

Historical Windows Command Prompt example showing the Good signature message and complete primary key fingerprint in GPG output
Historical Windows result example. Follow the current two-file command above.
Historical macOS Terminal example showing the Good signature message and complete primary key fingerprint in GPG output
Historical macOS result example. Follow the current two-file command above.

If verification does not succeed

If GPG cannot find or open a file

A message such as No such file, cannot open, no signed data, or missing data file normally indicates a filename or path problem. Confirm that both matching files are present, insert both paths in the two-file verification command, and run it again. You do not need to delete either file because of a path error.

If GPG reports “No public key”

Return to Inspect the Shift Crypto signing key. Compare the complete fingerprint, import the inspected key only after it matches, and run the verification again.

If GPG reports “BAD signature”

Do not open, extract, install, or run the installation file.

  1. Delete the installation file.
  2. Delete its matching .asc signature file.
  3. Open the official BitBoxApp releases page independently.
  4. Download the installation file again.
  5. Download the matching .asc file again.
  6. Repeat the verification.

You do not need to delete a signing key whose complete fingerprint you already verified.

If the primary fingerprint is different

Do not import or trust the key, and do not use the installation file unless verification later succeeds with the expected key.

  1. Delete the downloaded public-key file.
  2. Open the official Shift Crypto signing-key link and the official BitBoxApp release page independently.
  3. Download the public-key file again.
  4. Inspect the new key file.
  5. Compare its complete primary fingerprint again.

If the fingerprint still differs, or if GPG reports a good signature made by a different key, do not continue. Contact BitBox Support.

If verification still fails

Contact BitBox Support before opening, extracting, installing, or running the file. Include your operating system, GnuPG version, exact installation and signature filenames, download source, displayed primary fingerprint, and complete GPG output.

Never include recovery words, a wallet backup, a password, a passphrase, a private key, a PIN, or an authentication code.

Alternative: AI-assisted signature verification

Use this alternative only with an AI model that can process the complete uploaded file, access the web, and execute GPG commands. BitBoxApp installation packages can exceed 200 MB, so support depends on the selected service and model. This method is easier than entering the commands yourself, but it provides lower assurance than local verification.

AI-assisted verification adds another party you must trust

AI can retrieve the wrong release, key, or signature, process the wrong file, fail to execute GPG, hallucinate, or misreport the result. Uploading also sends a copy of the public installation file to the provider. Use only a provider whose file-handling and retention terms you accept, and never upload recovery words, wallet backups, passwords, passphrases, private keys, PINs, authentication codes, or other wallet data.

 
  1. Upload the exact unopened BitBoxApp installation file you want to verify.
  2. Replace [VERSION] in the prompt below with the version shown in the filename.
  3. Send the prompt.
Attached is a download of the BitBoxApp.

Look at the GitHub releases page for [VERSION], fetch the key and signature, and verify the signature against the uploaded file.

Accept the result only if it:

  • identifies the exact uploaded filename and matching BitBoxApp release;
  • identifies the matching .asc signature filename;
  • shows the GPG command and reports the relevant GPG result;
  • reports a Good signature from ShiftCrypto Security <security@shiftcrypto.ch>; and
  • shows this complete primary fingerprint:
DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

The example also reports a matching SHA-256 checksum and an alternative source for the key. Neither replaces a good-signature result or an independent comparison of the complete fingerprint with the fingerprint published on the official release page.

If the model reports a bad signature, a different or incomplete fingerprint, the wrong filename or release, or cannot process the complete file, do not open, extract, install, or run it. Use the manual method or contact BitBox Support.

Related Articles

Was this article helpful?

Give feedback about this article