Subject: Bad Armour Headers

From: Ben Laurie <[email-masked]>
Date: Thu, 05 Jan 2006 14:28:20 +0000

draft 15 says:

"    The format of an Armor Header is that of a key-value pair.  A colon
    (':' 0x38) and a single space (0x20) separate the key and value.
    OpenPGP should consider improperly formatted Armor Headers to be
    corruption of the ASCII Armor. "

However, I see improperly formatted headers because of word wrapping.
There doesn't appear to be a way to wrap a long line, so I must reject
these as badly formatted (not that other implementations do, it seems).

This seems less than optimal.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: David Shaw <[email-masked]>
Date: Thu, 5 Jan 2006 10:06:29 -0500

> these as badly formatted (not that other implementations do, it seems).

GPG rejects these as well.  Word wrapping mangles clearsigned
documents as well, of course, so it's more than just an armor header
problem.

I'm not sure what can be done about that except to tell people "don't
corrupt the armor, please".

David

---

From: [email-masked] (Daniel A. Nagy)
Date: Thu, 5 Jan 2006 16:15:41 +0100

> This seems less than optimal.

Armor headers are very similar to MIME headers. In MIME, the solution is
that non-empty lines are appended to the previous line, if they begin with a
whitespace. This transformation can be used in OpenPGP too. In order to
prevent arbitrary wraps, the length of actual lines should be maximized in
64 characters, with longer lines broken in the above described fashion (with
a whitespace in the beginnig of the trailing part).

-- 
Daniel

---

From: Ben Laurie <[email-masked]>
Date: Thu, 05 Jan 2006 16:04:11 +0000

> a whitespace in the beginnig of the trailing part).

I would support this modification.

---

From: Werner Koch <[email-masked]>
Date: Thu, 05 Jan 2006 16:55:43 +0100

> a whitespace in the beginnig of the trailing part).

This could be used to attack a message in this way:

  -----BEGIN PGP SIGNED MESSAGE-----
  Hash: SHA1
  Comment: Created by SEOpenPGP
   _
   _The account to transfer the money to is
   _  123455667 at Phishers Bank Inc., Caiman Islands
   _ 
   _
   _Regards,
   _    Robert T. Offline
   _
   _--
   _This message is integrity protected.  Make sure that 
   _the popup window or status line showed that the
   _signature is good.
   _
   _
   _
[More pseudo blank lines to scroll stuff away]
  
   The account to transfer the money to is
     47110815 at Eco Bank, Frankfurt

   Regards,
       Robert T. Offline
  -----BEGIN PGP SIGNATURE-----
 [...]

By replacing the underscore with an invisible character this is close
to perfect but even with an underscore or an "> ", many users will
assume that the "Comment" line is just one line and the rest is
actually the signed message.

Shalom-Salam,

   Werner

---

From: David Shaw <[email-masked]>
Date: Thu, 5 Jan 2006 11:24:21 -0500

> a whitespace in the beginnig of the trailing part).

This would give a valid encoding for long header lines, but does not
fix the problem at hand.  Word wrapping would still result in broken
armor as word wrapping wouldn't know to put whitespace before the
lines it reformats.

I don't think this is something that OpenPGP should try to fix, beyond
perhaps an interoperability note to be careful of line lengths.

David

---

From: Ian G <[email-masked]>
Date: Thu, 05 Jan 2006 16:53:54 +0000

> This seems less than optimal.

It is, but the doc is silent on that issue.

I spotted this issue a year or two ago and brought
it up.  At the time, I had suggested that the doc
say "Armor Headers SHOULD be no more than the length
of the asciiarmor."  But there wasn't much enthusiasm
for that at the time.

And implementations seem to like long lines, so I
imagine the nuisance isn't going away.  It's just
another limitation of the clearsigned text format;
don't use long lines if you value the sig.

iang

---

From: [email-masked] (Daniel A. Nagy)
Date: Thu, 5 Jan 2006 17:52:40 +0100

I wrote:

> > In order to
> > 64 characters

> armor as word wrapping wouldn't know to put whitespace before the

There would be no word wrapping, if everything I propose becomes standard.
The concern of Werner is more of an issue, though. I will address it in a
separate posting.

-- 
Daniel

---

From: Ben Laurie <[email-masked]>
Date: Thu, 05 Jan 2006 17:21:21 +0000

> armor as word wrapping wouldn't know to put whitespace before the

Word wrapping would not occur because the lines would be short enough to
avoid it.

---

From: David Shaw <[email-masked]>
Date: Thu, 5 Jan 2006 12:53:23 -0500

> Word wrapping would not occur because the lines would be short enough to

No, this would still happen if the implementation generated lines that
were too long.  Since the OpenPGP generally has no idea where the
editor is going to wrap, it is difficult for the implementation to get
this right.

Incidentally, I believe this is legal now:

  Comment: this is the first part of my comment
  Comment: this is the second part of my comment

I'd recommend that over a new encoding for line-wrapped armor headers
that will have to be added to all the existing armor parsers.

David

---

From: David Shaw <[email-masked]>
Date: Thu, 5 Jan 2006 13:01:55 -0500

> There would be no word wrapping, if everything I propose becomes standard.

In common usage, a user creating an armored message (or clearsigned
message which has the same problem) uses an OpenPGP program and some
editor.  These two programs do not communicate, so I do not see how
the OpenPGP program can know where to fold the lines to prevent the
editor from coming along and wrapping.  Whatever (reasonable) magic
number is used as the maximum number of columns, I am confident there
is a word wrap setting that will clobber it.

This problem basically exists in the "Comment" and "Version" header
lines.  Both are essentially comments, are optional, and carry nothing
vital to OpenPGP.  Rather than invent a whole new encoding for long
lines, that involves modifying many deployed parsers for the benefit
of having longer comments, why not just add a warning to the draft
that says in effect "long comments may break you - be careful".

David

---

From: Ian G <[email-masked]>
Date: Thu, 05 Jan 2006 19:01:49 +0000

> Word wrapping would not occur because the lines would be short enough to

Word wrapping can occur at any length.  I've seen it at
50 chars or so, which was pretty extreme.

The reason I say that the header lines SHOULD BE NO LONGER
than the ascii-armor is because if the wordwrap / slice
limit is less than the ascii-armor, then we're sunk anyway.

Although I suppose it is possible to strike a wordwrap
but not slice artifact.

 > that will have to be added to all the existing armor parsers.

Definately.  I don't see any need to change the
format of the comments to solve this problem, it
seems to be thrashing a dead horse.

iang

---

From: Ben Laurie <[email-masked]>
Date: Fri, 06 Jan 2006 12:47:25 +0000

> that will have to be added to all the existing armor parsers.

Good idea.

---

From: Jon Callas <[email-masked]>
Date: Fri, 6 Jan 2006 16:10:46 -0800

> This seems less than optimal.

I'm going to weasel here, as well as lawyer. It says "should." It  
even says it in lowercase, not SHOULD. That means that as long as you  
understand the ramifications of what you're doing (like the case  
Werner brings up), you can do what you want.

I've always thought it would be useful to have some software that was  
a wrapper around core OpenPGP things that would verify a signature  
with some heuristics that could undo obvious breakage like wrapping  
bizarreness, formatting braindamage like quoted-printable on  
printable characters, and so on.

	Jon

---

From: Jon Callas <[email-masked]>
Date: Fri, 6 Jan 2006 16:14:30 -0800

> that will have to be added to all the existing armor parsers.

I also think this is legal, and a fine idea. Echoing Werner and  
others, the Comment: header is really just a bumper sticker.

	Jon