Subject: Signature Subpacket 10?

From: Ben Laurie <[email-masked]>
Date: Thu, 30 Jun 2005 09:27:40 +0100

I see it is reserved "for backward compatibility". I'm curious to know: 
what's in this packet? Is it documented somewhere?

Cheers,

Ben.

-- 
 >>>ApacheCon Europe<<<                   http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Werner Koch <[email-masked]>
Date: Thu, 30 Jun 2005 12:30:15 +0200

On Thu, 30 Jun 2005 09:27:40 +0100, Ben Laurie said:

> I see it is reserved "for backward compatibility". I'm curious to
> know: what's in this packet? Is it documented somewhere?

    SIGSUBPKT_ARR	   =10, /* additional recipient request */

aka additional decrytpion key.

Salam-Shalom,

   Werner

---

From: Ian Grigg <[email-masked]>
Date: Thu, 30 Jun 2005 12:16:26 +0100

> aka additional decrytpion key.

A little background.  This was added by the old
PGP Inc company for commercial users so as to
escrow email.  If a key had this subpacket, you
would encrypt to that additional key as well.

The notion was that it should go
in the standard, but that was politically charged
at the time - indeed Loius Freeh stood up in
front of Congress and used this very feature as
proof that it was possible to force all crypto
programs to escrow messages for the FBI...

The compromise that was reached was that it
not be documented in the standard.  I don't
know if GPG implements it, or even if it the PGP
line still includes it.  I think architecturally speaking,
such a feature is better off in the proxy products,
and layered over the top at the admin level
rather than put in the tech.  I think it is relatively
safe to ignore it.

iang
-- 
Advances in Financial Cryptography, Issue 2:
   https://www.financialcryptography.com/mt/archives/000498.html
Mark Stiegler, An Introduction to Petname Systems
Nick Szabo, Scarce Objects
Ian Grigg, Triple Entry Accounting

---

From: Werner Koch <[email-masked]>
Date: Thu, 30 Jun 2005 13:52:27 +0200

> programs to escrow messages for the FBI...

I did not know that; interesting.  The ARR became known due to a bug
in the implementation at that time.

> know if GPG implements it, or even if it the PGP

No, never did it.  We only have a warning for that bug:

    if ( type == SIGSUBPKT_ARR && !hashed ) {
        fprintf (listfp,
                 "\tsubpkt %d len %u (additional recipient request)\n"
                 "WARNING: PGP versions > 5.0 and < 6.5.8 will automagically "
                 "encrypt to this key and thereby reveal the plaintext to "
                 "the owner of this ARR key. Detailed info follows:\n",
                 type, (unsigned)length );
    }

Shalom-Salam,

   Werner

---

From: Ben Laurie <[email-masked]>
Date: Thu, 30 Jun 2005 13:13:02 +0100

> rather than put in the tech.  I think it is relatively

Aha. Well, I'd like to be able to extract the data, just for 
completeness. Does anyone have a format for the packet?

Cheers,

Ben.

--

---

From: David Shaw <[email-masked]>
Date: Thu, 30 Jun 2005 09:01:02 -0400

> completeness. Does anyone have a format for the packet?

I believe it is the same as the format for the designated revocation
subpacket (#12).  A class byte, followed by an algorithm byte for the
public key algorithm of the key being ARR-ed to, followed by the (V4)
fingerprint of the ARR key.

The class byte has bits defined to express "please follow this ARR" or
"you must follow this ARR", but I'm afraid I don't know which bits
mean what offhand.

David

Date: Thu, 30 Jun 2005 09:01:02 -0400
From: David Shaw <[email-masked]>
To: OpenPGP <[email-masked]>
Subject: Re: Signature Subpacket 10?
Mail-Followup-To: OpenPGP <[email-masked]>
OpenPGP: id=99242560; url=http://www.jabberwocky.com/david/keys.asc
Sender: [email-masked]

> completeness. Does anyone have a format for the packet?

I believe it is the same as the format for the designated revocation
subpacket (#12).  A class byte, followed by an algorithm byte for the
public key algorithm of the key being ARR-ed to, followed by the (V4)
fingerprint of the ARR key.

The class byte has bits defined to express "please follow this ARR" or
"you must follow this ARR", but I'm afraid I don't know which bits
mean what offhand.

David

Date: Thu, 30 Jun 2005 13:13:02 +0100
From: Ben Laurie <[email-masked]>
To: Ian Grigg <[email-masked]>
CC: Werner Koch <[email-masked]>, OpenPGP <[email-masked]>
Subject: Re: Signature Subpacket 10?
Sender: [email-masked]

Cheers,

Ben.

-- 

To: Ian Grigg <[email-masked]>
Cc: Ben Laurie <[email-masked]>, OpenPGP <[email-masked]>
Subject: Re: Signature Subpacket 10?
From: Werner Koch <[email-masked]>
Organisation: g10 Code GmbH
OpenPGP: id=5B0358A2; url=finger:[email-masked]
Date: Thu, 30 Jun 2005 13:52:27 +0200
Sender: [email-masked]

Shalom-Salam,

   Werner

From: Ian Grigg <[email-masked]>
To: Ben Laurie <[email-masked]>
Subject: Re: Signature Subpacket 10?
Date: Thu, 30 Jun 2005 12:16:26 +0100
Cc: Werner Koch <[email-masked]>, OpenPGP <[email-masked]>
Sender: [email-masked]

iang

To: Ben Laurie <[email-masked]>
Cc: OpenPGP <[email-masked]>
Subject: Re: Signature Subpacket 10?
From: Werner Koch <[email-masked]>
Organisation: g10 Code GmbH
OpenPGP: id=5B0358A2; url=finger:[email-masked]
Date: Thu, 30 Jun 2005 12:30:15 +0200
Sender: [email-masked]

Salam-Shalom,

   Werner

Date: Thu, 30 Jun 2005 09:27:40 +0100
From: Ben Laurie <[email-masked]>
To: OpenPGP <[email-masked]>
Subject: Signature Subpacket 10?
Sender: [email-masked]

Cheers,

Ben.

-- 

From: [email-masked] (Peter Gutmann)
To: [email-masked], [email-masked]
Subject: Re: Power function PGP math library?
Cc: [email-masked], [email-masked], [email-masked]
Date: Wed, 22 Jun 2005 13:16:28 +1200
Sender: [email-masked]

Ben Laurie <[email-masked]> writes:
>Peter Gutmann wrote:
>>>openssl
>>
>>The code is the crypto equivalent of Heathrow Airport.
>
>The bignum code is reasonably OK :-)

I'd always seen that as the bit with all the excavators :-).

Peter.

Date: Tue, 21 Jun 2005 16:55:35 +0100
From: Ben Laurie <[email-masked]>
To: Peter Gutmann <[email-masked]>
CC: [email-masked], [email-masked], [email-masked]
Subject: Re: Power function PGP math library?
Sender: [email-masked]

Peter Gutmann wrote:
>>openssl
> 
> The code is the crypto equivalent of Heathrow Airport.

The bignum code is reasonably OK :-)

-- 

From: [email-masked] (Peter Gutmann)
To: [email-masked], [email-masked], [email-masked]
Subject: Re: Power function PGP math library?
Date: Fri, 17 Jun 2005 23:24:35 +1200
Sender: [email-masked]

[email-masked] ("Hal Finney") writes:

>I have to say that I think there are better choices for math libraries these
>days than that old code.  gmp, crypto++ and openssl are three that I have
>used and are good quality.  I've also heard good things about libtommath.
>You can find more about any of these via google.

Some thoughts:

>gmp,

Needs GNU-everything-else in order to build, a problem if you're targetting
multiple platforms and need to use non-GNU tools (e.g. VC++).

>crypto++

Extreme C++, both in the code style and the requirements it places on
compilers.

>openssl

The code is the crypto equivalent of Heathrow Airport.

>libtommath

Very nice, although it suffers the no-visible-means-of-support problem that
killed the earlier (and equally nice) bnlib: What happens if the author gets
tired of maintaining it?

Peter.

To: [email-masked], [email-masked]
Subject: Re: Power function PGP math library?
Date: Thu, 16 Jun 2005 23:25:28 -0700 (PDT)
From: [email-masked] ("Hal Finney")
Sender: [email-masked]

Kimmo writes:
> I need to verify the DSA signature in my application, and the verifier has 
> to compute these parameters, which are defined in the DSS (Digital Signature 
> Standard).
>
> w = (s')^-1 mod q
> u1 = ((SHA(M')w) mod q
> u2 = ((r')w) mod q
> v = (((g)^u1 * (y^u2) mod p) mod q
>
> I'm using PGP math library in calculation. The problem is how to calculate 
> parameter v.
>
> The parameters g (power to u1) and y (power to u2) should be calculated 
> first and then these factors should be calculated together and so on. But 
> there isn't a function in the math library to calculate powers. The 
> calculation could be done with mp_mult, but it is very slow way to do it.

If you are using the math library I think, the one that came with the
old, old version 2.x of PGP, you can look at a web page I wrote back in
1993 that describes the math library,
http://www.finney.org/~hal/pgp_math_lib.html.  There you will see that
there is in fact a function to calculate powers, mp_modexp.  This does
a modular exponentiation, so you would use p as the modulus to calculate
g^u1 and y^u2, then multiply them together using mp_modmult.  Note that
mp_modmult does not take a modulus parameter, rather you have to call
stage_modulus with p before calling mp_modmult.  Then you can use mp_mod
to take v mod q.

I have to say that I think there are better choices for math libraries
these days than that old code.  gmp, crypto++ and openssl are three
that I have used and are good quality.  I've also heard good things
about libtommath.  You can find more about any of these via google.

Hal Finney

Date: Fri, 17 Jun 2005 09:08:21 +0200 (CEST)
Subject: Re: Power function PGP math library?
From: "Konrad Rosenbaum" <[email-masked]>
To: Kimmo =?iso-8859-1?Q?M=E4kel=E4inen?= <[email-masked]>
Cc: [email-masked]
Importance: Normal
Sender: [email-masked]

Kimmo Mäkeläinen said:
> v = (((g)^u1 * (y^u2) mod p) mod q
>
> I'm using PGP math library in calculation. The problem is how to calculate
> parameter v.
>
> The parameters g (power to u1) and y (power to u2) should be calculated
> first and then these factors should be calculated together and so on. But
> there isn't a function in the math library to calculate powers. The
> calculation could be done with mp_mult, but it is very slow way to do it.

Basic modular math:

(g^u1 * y^u2) mod p == ( ((g^u1)mod p) * ((y^u2) mod p) ) mod p

you do not really want to calculate g^u1 or y^u2 since it will be a Really
Big Number [tm].

     Konrad

From: =?iso-8859-1?B?S2ltbW8gTeRrZWzkaW5lbg==?= <[email-masked]>
To: [email-masked]
Subject: Power function PGP math library?
Date: Fri, 17 Jun 2005 08:55:10 +0300
Sender: [email-masked]

Hey,

I need to verify the DSA signature in my application, and the verifier has 
to compute these parameters, which are defined in the DSS (Digital Signature 
Standard).

w = (s')^-1 mod q
u1 = ((SHA(M')w) mod q
u2 = ((r')w) mod q
v = (((g)^u1 * (y^u2) mod p) mod q

I'm using PGP math library in calculation. The problem is how to calculate 
parameter v.

The parameters g (power to u1) and y (power to u2) should be calculated 
first and then these factors should be calculated together and so on. But 
there isn't a function in the math library to calculate powers. The 
calculation could be done with mp_mult, but it is very slow way to do it.

Best regards,

Kimmo

_________________________________________________________________
Nopea ja hauska tapa lähettää viestejä reaaliaikaisesti - MSN Messenger. 
http://messenger.msn.fi

Date: Tue, 07 Jun 2005 08:04:21 +0100
From: Ben Laurie <[email-masked]>
To: Derek Atkins <[email-masked]>
CC: Hal Finney <[email-masked]>, [email-masked], [email-masked]
Subject: Re: Problems with calculating signatures over keys
Sender: [email-masked]

Derek Atkins wrote:
> Hal,
> 
> <chair hat>
> 
> [email-masked] ("Hal Finney") writes:
> 
> 
>>We might want to consider some "test vectors" in the RFC which work
>>through the process of verifying a signature.  We'd show the key and
>>associated packets, and then show the exact sequence of bytes which
>>gets hashed.  I think that would be a big help to implementors.
> 
> 
> I agree that this would be a boon to implementors.  Do you want to
> volunteer to do this?  :)
> 
> 
>>Unfortunately once we open the door to including such an example,
>>there are a lot of other things we might need to show.  The public key
>>signature operations themselves, signatures on text and binary messages,
>>encryption and decryption, encrypt+sign, etc.  We could almost use a
>>separate RFC just with examples as an aid to implementors.
> 
> 
> I also agree that a separate "Test Vectors" draft would be the right
> place to put it.  It could even be an informational draft instead of a
> standards-track draft, but it could still be called something like:
>    draft-ietf-openpgp-test-vectors
> 
> 
>>Hal Finney
> 
> 
> Are there any objections from the WG to doing this?  As chair I think
> it's a good idea and would welcome a test vectors draft.

Sounds good to me.