Subject: Re: Outstanding question - rule on cleartext signing last line

From: <[email-masked]>
Date: Mon, 26 Dec 2005 15:05:37 -0800

On Mon, 26 Dec 2005 13:32:13 -0800 "Daniel A. Nagy" 
<[email-masked]> wrote:
>On Mon, Dec 26, 2005 at 05:03:59PM +0000, Ben Laurie wrote:
>
>> I have just tested GPG yet again, and cleartext signatures of 
>two files,
>> one without a newline at the end, and one with, look identical:
>> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> test
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.2 (FreeBSD)
>
>Yepp, that's a bug in GPG and it does not follow from the spec. My
>implementation does not do that. In my opinion, the correct 
>behavior would
>be reversible.
>The output of gpg --clearsign should be identical to that 
>converted from the
>output of gpg -ts.

i really can't see any bug in gnupg about this

gnupg clearsigns exactly what the user gives it

if the user gives it text with no empty line after it,
then the signature block begins right after the text

if the user wants a blank line and includes the line return, 
then gnupg signs after the empty line

they are *not* identical or interchangeable

here are two, one with the empty line, 
and one without:

 test

test

addition or subtraction of the empty line, invalidates the signature

and this is also true of all commandline pgp versions

vedaal

Concerned about your privacy? Instantly send FREE secure email, no account required
http://www.hushmail.com/send?l=480

Get the best prices on SSL certificates from Hushmail
https://www.hushssl.com?l=485

---

From: Ben Laurie <[email-masked]>
Date: Tue, 27 Dec 2005 06:04:46 +0000

> then gnupg signs after the empty line

Not the version I'm using, as I've already stated, and in any case, my
issue is with clarity in the I-D.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Ian G <[email-masked]>
Date: Tue, 27 Dec 2005 09:09:02 +0000

[email-masked] wrote:
> Hash: SHA256
> Version: GnuPG v1.4.2 (MingW32)

My results do not agree.  If there is no terminating
newline, GPG adds it (as it must).  If there is a
terminating line, GPG does not add one.  I'm using
FreeBSD and 1.4.2.

iang

galland$ echo "test" > test
galland$ cat test
test
galland$ gpg -ats -u DSS3 test
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information

You need a passphrase to unlock the secret key for
user: "Ian Grigg DSS3 <[email-masked]>"
1024-bit DSA key, ID DABCCA96, created 2000-03-26

galland$ cat test.asc

test
galland$ cat test
test
galland$ echo -n "test" > test
galland$ cat test
galland$ gpg -ats -u DSS3 test
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information

You need a passphrase to unlock the secret key for
user: "Ian Grigg DSS3 <[email-masked]>"
1024-bit DSA key, ID DABCCA96, created 2000-03-26

File `test.asc' exists. Overwrite? (y/N) y
galland$ cat test.asc

test

---

From: [email-masked] (Daniel A. Nagy)
Date: Tue, 27 Dec 2005 10:56:52 +0100

> terminating line, GPG does not add one.  I'm using

Same with 1.4.1. and 1.4.2 on Linux and Cygwin

-- 
Daniel