Subject: Re: Bad Armour Headers

From: Matthew Byng-Maddick <[email-masked]>
Date: Fri, 6 Jan 2006 00:50:36 +0000

[This may get through twice - I sent it from the wrong address earlier]

On Thu, Jan 05, 2006 at 04:55:43PM +0100, Werner Koch wrote:
> On Thu, 5 Jan 2006 16:15:41 +0100, Daniel A Nagy said:
[>> long header lines, wrapped (2)822-style]
[> attack based on message in the header-lines]
> By replacing the underscore with an invisible character this is close
> to perfect but even with an underscore or an "> ", many users will
> assume that the "Comment" line is just one line and the rest is
> actually the signed message.

If you use gpg --decrypt on such a message, then it will output the
signed text, which of course is not in the header. In my mailer (mutt)
it recognises the signed text as such and wraps (and displays) that. I
feel that anyone looking at the original source of even ASCII-armoured
mail rather than checking the signature for anything of that kind of
importance might well deserve what they get.

(Obviously, Werner, I appreciate that you know what GnuPG does in this
 situation, but I wanted to make the point that using the output of
 what the openpgp transformation does when it reads the ascii armoured
 text. It seems almost sensible that there SHOULD be a way of outputting
 this in normal context, but we're in last call, and I don't think it's
 appropriate to start adding wording.)

Cheers

MBM

-- 
Matthew Byng-Maddick          <[email-masked]>           http://colondot.net/
                      (Please use this address to reply)

---

From: Werner Koch <[email-masked]>
Date: Fri, 06 Jan 2006 10:22:38 +0100

> it recognises the signed text as such and wraps (and displays) that. I

I know that given that as I heavily hacked on mutt's crypto code.
However mutt is not ust by the average user and mutt's users usually
use PGP/MIME where such a problem does not exist.

We talked about editors or MUAs with a bad line wrap behavior; that is
that these MUAs are not OpenPGP aware and many users are using the
clipboard to cut and paste signatures. 

>  appropriate to start adding wording.)

Agreed

Salam-Shalom,

   Werner

---

From: [email-masked] (Daniel A. Nagy)
Date: Fri, 6 Jan 2006 12:24:03 +0100

> clipboard to cut and paste signatures. 

Really? Are there more cut&paste'ers than mutt users? Not that I don't
believe you, but it would be nice to know how to estimate UI preferences.

Actually, my java applet OpenPGP client (which relies on cut&paste for
input) also removes the headers from verified clearsigned documents.
 
-- 
Daniel

---

From: Werner Koch <[email-masked]>
Date: Fri, 06 Jan 2006 14:12:58 +0100

> believe you, but it would be nice to know how to estimate UI preferences.

Even for Unix systems mutt is by far not the major MUA.  Kmail,
Evolution and Mozilla are used more often.  AFAIK, Windows users often
use cut+paste to encrypt or sign messages.

> input) also removes the headers from verified clearsigned documents.
 
Frankly, I believe that all headers except for Hash are not very
useful.  People are often bemused if you tell them that they should
use sed to fix or add armor header lines.  I am pretty sure many of
them believe that the armor header lines are part of the signed text
which does not wonder me because a line just above says "begin pgp
signed message" and not "pgp signed messages begins after the next
blank line".

Salam-Shalom,

   Werner

---

From: [email-masked] (Daniel A. Nagy)
Date: Fri, 6 Jan 2006 22:05:41 +0100

> signed message" and not "pgp signed messages begins after the next

That is precisely why I think that headers should not be displayed when
reporting on successful verification, but that's just a "best practice" and
has little bearing on the standard.

Otherwise, I agree with you that cleartext signed messages are least
ambiguous with just Hash headers and nothing else before the clearsigned
content. Maybe, we should consider disallowing everything else? After all,
version information and other stuff can go to the armor header of the
signature. Placing headers before the actual clearsigned content is
confusing, indeed. I don't think that many implementations use this
"feature", so by disallowing it, we might not break anythink. What do you
think?

-- 
Daniel

---

From: David Shaw <[email-masked]>
Date: Fri, 6 Jan 2006 16:42:53 -0500

> "feature", so by disallowing it, we might not break anythink. What do you

I think it is already done this way.  Section 7 says:

    The cleartext signed message consists of:

      - The cleartext header '-----BEGIN PGP SIGNED MESSAGE-----' on a
        single line,

      - One or more "Hash" Armor Headers,

      - Exactly one empty line not included into the message digest,

      - The dash-escaped cleartext that is included into the message
        digest,

      - The ASCII armored signature(s) including the '-----BEGIN PGP
        SIGNATURE-----' Armor Header and Armor Tail Lines.

Seems fairly clear that the only header that should go before the text
is "Hash".  Comment and/or Version would need to go in the BEGIN PGP
SIGNATURE/END PGP SIGNATURE block at the end of the document.

Does any implementation actually generate Comment and/or Version
headers before the clearsigned text (rather than in the armored
signature at the end of the clearsigned text) ?

David