PGP Guide: Verifying Nexus Market Onion Signatures

01// The Importance of Signed Mirrors

When establishing an active session with Nexus Market, cybercriminals often attempt to intercept interactions using malicious proxy mirrors. These malicious mirrors replicate the visual layout of the legitimate market front-end, designed explicitly to capture your PINs, passwords, and private keys.

To combat this, the operators of Nexus Market sign official address lists utilizing a PGP private key. The identity of this key resides in a publicly circulated public key. By checking the cryptographic signature of an address list against the official public key, you assure that the list was created by the actual Nexus Market admins, ensuring the addresses are authentic.

02// Importing the Official Nexus Market Public Key

Before attempting any verification, you need to import the market's master public key into your GnuPG keyring. You can achieve this using standard terminal utilities or graphics-driven environments like Kleopatra.

First, secure the correct raw public key block from a trusted external distributor or offline storage. Save this text as a file named nexus_pub.asc. Once saved, execute the following command in your terminal:

$ gpg --import nexus_pub.asc

The shell will return an output confirming the identity and fingerprint of the key just added to your key-ring:

gpg: key 0x9BA27F701108D9F2: public key "Nexus Market Operations <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

03// Step-by-Step Signature Verification

The admin-signed message contains two main components: the plaintext containing the authorized .onion domains, and the ASCII-armored signature block appended directly below it.

To proceed, copy the signed text file completely, ensuring you capture -----BEGIN PGP SIGNED MESSAGE----- all the way down to -----END PGP SIGNATURE-----. Save it to your local environment as mirrors.txt. Run the following CLI validation command:

$ gpg --verify mirrors.txt

Examine the terminal response. You are looking for a key indicator confirming the integrity of the data stream:

gpg: Signature made Wed Oct 25 14:22:11 2023 UTC
gpg:                using RSA key 0x9BA27F701108D9F2
gpg: Good signature from "Nexus Market Operations <[email protected]>" [ultimate]

04// Critical Safety Standard checklist

To protect your funds and keep your account details secure on the Nexus Market network, adhere strictly to this secure operational protocol:

• Never bypass verification: Even if you found the link on a well-known resource, confirm the signature yourself before taking any actions.
• Check your address bar: Make sure the .onion link matches the list you verified line-by-line.
• Store verified signatures offline: Keep local text files of verified .onion links so you don't have to keep retrieving them from online sources.
• Update keys periodically: Expired keys or emergency key-rotations will be broadcast on official distribution nodes. Keep your local keyring current.

05// Understanding the "Good Signature" Warning

If you run a verification and see a warning stating: "This key is not certified with a trusted signature!", don't worry. This is standard behavior for PGP.

It simply means you have not locally signed this key to state that you trust the identity of the owner. This doesn't indicate an issue with the cryptographic validity of the signature itself. As long as GnuPG outputs "Good signature", the link text is verified as authentic and has not been altered since it was signed.