Sender signature verification (Beta)
CFT supports Sender Signature Verification, adding a layer of protection to existing data security controls such as encryption and decryption. This feature validates the authenticity of the sender and ensures that the file has not been tampered with during transit.
Quick reference
- CFT supports signature verification for PGP only (OpenPGP RFC 4880 compliant).
- Sender Decryption is required to be enabled on the same workflow.
- Both Armored and Binary PGP files are supported.
- Only Tenant Managers can create and manage PGP keys.
Understanding the verification flow
When signature verification is enabled, the file must be decrypted successfully first before it can be verified.
Sender → CFT decrypts file → CFT verifies signature → CFT scans file → Receiver
- If either decryption or verification fails, the transfer is stopped.
- If both checks pass, the status advances to the scanning phase.
The status of the transfer at each stage can be monitored in the Admin Portal logs.
Prerequisites
To enable this feature, you must create two keys in the CFT Admin Portal:
Sender Key: Used for file decryption.
Sender Signature Verification Key: Used to verify the signature. Only PGP type is supported for now.
For more information, refer to Understanding key types.
Set up File Signature Verification
Follow these steps to configure signature verification in your transfer workflow.
| Step | Task | Environment | Notes |
|---|---|---|---|
| 1 | Create a Sender key | CFT Admin Portal | Required for decryption. |
| 2 | Create a Signature Verification key | CFT Admin Portal | Key type should be PGP. |
| 3 | Sign your file | Tenant System | Use the Sender Signature Verification (Private) key in Step 2 to sign your file. |
| 4 | Encrypt your file | Tenant System | Use the Sender (Public) key in Step 1 to encrypt your file. |
| 5 | Enable Sender signature verification + Sender file decryption | CFT Admin Portal | Configure within your Workflow. |
| Optional | Enable verification status webhook | CFT Admin Portal | This is optional. Refer to Webhooks section. |
Troubleshooting
Refer to the Troubleshooting guide for a list of common errors and resolutions.
