From ublument at Bear.com Sun Apr 1 03:42:10 2007 From: ublument at Bear.com (Blumenthal, Uri) Date: Sat, 31 Mar 2007 21:42:10 -0400 Subject: Problem interoperating with PGP Universal? Message-ID: David, Are you in touch with Enigmail developers? Or should I post your question on Enigmail list? And thanks for jumping in - there is no further response to my original question at Enigmail forum (besides recommendation to talk to GnuPG developers). Sent by GoodLink (www.good.com) -----Original Message----- From: David Shaw [mailto:dshaw at jabberwocky.com] Sent: Saturday, March 31, 2007 05:56 PM Eastern Standard Time To: gnupg-users at gnupg.org Subject: Re: Problem interoperating with PGP Univeral? On Sat, Mar 31, 2007 at 11:29:54PM +0200, Patrick Brunschwig wrote: > Blumenthal, Uri wrote: > > I am trying to get cleartext-signed PGP/MIME messages produced by PGP > > Universal 2.5.3, verified by email clients (Thunderbird-1.5.0.10 + > > Enigmail-0.94.2 + GPG-1.4.7). > > > > So far my experience is: > > > > - Pure plaintext (neither PGP/MIME nor PGP/Partitioned) messages are > > verified OK. > > > > - PGP/MIME encrypted and signed messages are decrypted and verified OK. > > > > - PGP/MIME or PGP/Partitioned messages (HTML body and/or attachments) > > fail signature verification, with error message from GPG: > > > > Cleartext signature without data > > > > I've submitted help request to Enigmail list, but perhaps somebody here > > can advise me regarding this issue? Maybe there are settings at PGP > > Universal that should be changed to make its output "friendlier"? Or > > maybe there are GPG setting that would allow verification of those > > emails? > > > > I'll be grateful for any help! > > > > Thank you! > > I can provide some more details on this. GnuPG 1.4.7 returns with this > error message "gpg: can't handle this ambiguous signature data". > > This is the detached signature that comes with such a message: > > -----BEGIN PGP SIGNATURE----- > Version: PGP Universal 2.5.3 > > qANQR1DEDQMBAhH9zteyosL+MwHCPwMFAUYL2iX9zteyosL+MxECC8QAnRhWP2Sx > Ex7VcRL+wBVB2C7lksYAAKCYHvRP7E8vA5jKNgigU0o4kbFn4w== > =lOCI > -----END PGP SIGNATURE----- That's just a regular signature. How does Enigmail call GPG to do the verification? David _______________________________________________ Gnupg-users mailing list Gnupg-users at gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users *********************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. *********************************************************************** From randux at Safe-mail.net Sun Apr 1 08:40:17 2007 From: randux at Safe-mail.net (randux at Safe-mail.net) Date: Sun, 1 Apr 2007 09:40:17 +0300 Subject: comment and version fields. Message-ID: Date: Tue, 27 Mar 2007 23:25:58 -0400 On Wed, Mar 28, 2007 at 03:03:39AM +0300, randux at Safe-mail.net wrote: > Greetings all, > > I came upon something a bit odd in gnupg 1.4.7. I found I can change > the comment field in a signed message to be whatever I like. I > should think this is a bad thing as an attacker could insert text in > a message presumably protected against all modifications if the > signature verifies properly. The "comment" and "version" armor fields are both essentially comments, and are ignored by the OpenPGP protocol. You can change either of them to whatever you like. David Thanks for your reply, David. I apologise for not responding sooner but I've been awaiting the list digest which came a week later! I understand your point as to the protocol ignoring changes to these fields. I suppose its futile to try to change a standard but it seems that it might be very damaging indeed to have a signed message altered after signing. That seems to defeat the reason for signing as the common person would assume that a signed message is protected entirely against unauthorised changes. Cheers, Rand From rjh at sixdemonbag.org Sun Apr 1 22:05:37 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Sun, 1 Apr 2007 15:05:37 -0500 Subject: comment and version fields. In-Reply-To: References: Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > fields. I suppose its futile to try to change a standard but it > seems that it might be very damaging indeed to have a signed > message altered after signing. That seems to defeat the reason for > signing as the common person would assume that a signed message is > protected entirely against unauthorised changes. The signed message _is_ protected entirely against unauthorized changes. Or, rather, as close to "entirely" as you can get with our current level of cryptography. The signature block is just a private-key encryption of the digest of the message, plus a few additional bits of information of use to OpenPGP. That private-key encryption of the digest of the message is the signature. Everything else is, to some degree, irrelevant, with some things being more irrelevant than others. If you alter a comment field, you're not altering either the original message nor the private-key encryption of the digest of the message. So what's the complaint? How is this tampering with the signature scheme? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iQEcBAEBCAAGBQJGEBCSAAoJELcA9IL+r4EJzS4IANXJtvWSKnxWBA4oowoyaRtG QrQGSv1LQJ9sreJ0c+GmxTF8K9Hi+gTRPeoIy5NUN4HJV5x+TbxmkTpO1QvcVsgN DfZYYf3sZugMOIdzQzbp0F63Z0SAV2Lz4NtRMiD6HflvQHovdE0V8k6M6G23XvcY QLstIn+XMRWBdIXX2zE7RZxNGY73TOSobNI0lDcjMyoBrSkMSdkJ4QdJv07ChI5t 5X+/mwpdh4KU41DE/osuqwcV/vUCqJ7+EKhdKlvHNqlhWMvJnabL3ssvopgTU9yv 1oqLR14toInTrUZGJ8mxkEmzdDKRm53qEfGKEmmsTNS0w5QBUgDRBOJY3ZgDis4= =8OOA -----END PGP SIGNATURE----- From patrick at mozilla-enigmail.org Mon Apr 2 09:40:39 2007 From: patrick at mozilla-enigmail.org (Patrick Brunschwig) Date: Mon, 02 Apr 2007 09:40:39 +0200 Subject: Problem interoperating with PGP Univeral? In-Reply-To: <20070331215147.GB21090__23357.429719954$1175378029$gmane$org@jabberwocky.com> References: <20070331215147.GB21090__23357.429719954$1175378029$gmane$org@jabberwocky.com> Message-ID: <4610B377.1060303@mozilla-enigmail.org> David Shaw wrote: > On Sat, Mar 31, 2007 at 11:29:54PM +0200, Patrick Brunschwig wrote: >> Blumenthal, Uri wrote: >>> I am trying to get cleartext-signed PGP/MIME messages produced by PGP >>> Universal 2.5.3, verified by email clients (Thunderbird-1.5.0.10 + >>> Enigmail-0.94.2 + GPG-1.4.7). >>> >>> So far my experience is: >>> >>> - Pure plaintext (neither PGP/MIME nor PGP/Partitioned) messages are >>> verified OK. >>> >>> - PGP/MIME encrypted and signed messages are decrypted and verified OK. >>> >>> - PGP/MIME or PGP/Partitioned messages (HTML body and/or attachments) >>> fail signature verification, with error message from GPG: >>> >>> Cleartext signature without data >>> >>> I've submitted help request to Enigmail list, but perhaps somebody here >>> can advise me regarding this issue? Maybe there are settings at PGP >>> Universal that should be changed to make its output "friendlier"? Or >>> maybe there are GPG setting that would allow verification of those >>> emails? >>> >>> I'll be grateful for any help! >>> >>> Thank you! >> I can provide some more details on this. GnuPG 1.4.7 returns with this >> error message "gpg: can't handle this ambiguous signature data". >> >> This is the detached signature that comes with such a message: >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Universal 2.5.3 >> >> qANQR1DEDQMBAhH9zteyosL+MwHCPwMFAUYL2iX9zteyosL+MxECC8QAnRhWP2Sx >> Ex7VcRL+wBVB2C7lksYAAKCYHvRP7E8vA5jKNgigU0o4kbFn4w== >> =lOCI >> -----END PGP SIGNATURE----- > > That's just a regular signature. How does Enigmail call GPG to do the > verification? > > David To be 100% clear: Uri has sent me the attached message msg-dump-bad.txt, which I extracted to file.txt and file.txt.asc. If I call gpg (1.4.7) with: "gpg --verify file.txt.asc file.txt" I get: "gpg: can't handle this ambiguous signature data" That's all the information I have. As far as I can tell, the message itself looks perfectly fine. -Patrick -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: msg-dump-bad.txt Url: /pipermail/attachments/20070402/c7f0d507/attachment.txt -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: file.txt Url: /pipermail/attachments/20070402/c7f0d507/attachment-0001.txt -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: file.txt.asc Url: /pipermail/attachments/20070402/c7f0d507/attachment.asc From wk at gnupg.org Mon Apr 2 11:24:45 2007 From: wk at gnupg.org (Werner Koch) Date: Mon, 02 Apr 2007 11:24:45 +0200 Subject: Problem interoperating with PGP Univeral? In-Reply-To: <4610B377.1060303@mozilla-enigmail.org> (Patrick Brunschwig's message of "Mon\, 02 Apr 2007 09\:40\:39 +0200") References: <20070331215147.GB21090__23357.429719954$1175378029$gmane$org@jabberwocky.com> <4610B377.1060303@mozilla-enigmail.org> Message-ID: <87wt0v163m.fsf@wheatstone.g10code.de> On Mon, 2 Apr 2007 09:40, patrick at mozilla-enigmail.org said: >>> I can provide some more details on this. GnuPG 1.4.7 returns with this >>> error message "gpg: can't handle this ambiguous signature data". Well, PGP is broken: Content-Type: text/plain; name="file.txt.asc" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="file.txt.asc" -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.5.3 qANQR1DEDQMBAhH9zteyosL+MwHCPwMFAUYL2iX9zteyosL+MxECC8QAnRhWP2Sx Ex7VcRL+wBVB2C7lksYAAKCYHvRP7E8vA5jKNgigU0o4kbFn4w== =lOCI -----END PGP SIGNATURE----- This should be a detached signature, but $ gpg --list-packets -v x.sig gpg: armor header: Version: PGP Universal 2.5.3 :marker packet: 50 47 50 :onepass_sig packet: keyid FDCED7B2A2C2FE33 version 3, sigclass 01, digest 2, pubkey 17, last=1 :signature packet: algo 17, keyid FDCED7B2A2C2FE33 version 3, created 1175181861, md5len 5, sigclass 0x01 digest algo 2, begin of digest 0b c4 data: [157 bits] data: [160 bits] So what we have is an ascii armor with a marker packet (that is okay), followed by a one-pass signature packet directly followed by the signature packet. Between the one-pass signature packet and the signature packet, a literal data packet is expected. Here is the OpenPGP packet grammar: An OpenPGP message is a packet or sequence of packets that corresponds to the following grammatical rules (comma represents sequential composition, and vertical bar separates alternatives): OpenPGP Message :- Encrypted Message | Signed Message | Compressed Message | Literal Message. Compressed Message :- Compressed Data Packet. Literal Message :- Literal Data Packet. ESK :- Public Key Encrypted Session Key Packet | Symmetric-Key Encrypted Session Key Packet. ESK Sequence :- ESK | ESK Sequence, ESK. Encrypted Data :- Symmetrically Encrypted Data Packet | Symmetrically Encrypted Integrity Protected Data Packet Encrypted Message :- Encrypted Data | ESK Sequence, Encrypted Data. One-Pass Signed Message :- One-Pass Signature Packet, OpenPGP Message, Corresponding Signature Packet. Signed Message :- Signature Packet, OpenPGP Message | One-Pass Signed Message. In addition, decrypting a Symmetrically Encrypted Data Packet or a Symmetrically Encrypted Integrity Protected Data Packet as well as decompressing a Compressed Data packet must yield a valid OpenPGP Message. A One-Pass Signed Message requires an OpenPGP Message and the other rules indicates that an empty OpenPGP Message is not allowed. Shalom-Salam, Werner From randux at Safe-mail.net Mon Apr 2 11:36:40 2007 From: randux at Safe-mail.net (randux at Safe-mail.net) Date: Mon, 2 Apr 2007 12:36:40 +0300 Subject: comment and version fields. Message-ID: From: Sven Radde Date: Mon, 02 Apr 2007 10:19:25 +0200 > Hi! > > randux at Safe-mail.net schrieb: > > The "comment" and "version" armor fields are both essentially > > comments, and are ignored by the OpenPGP protocol. You can change > > either of them to whatever you like. > > > > ... That seems to defeat the reason for signing > > as the common person would assume that a signed message > > is protected entirely against unauthorised changes. > > I agree with randux here. The Comment is within the "---PGP > SIGNATURE---" part and I, too, was not aware that it is not protected by > anything. (Do the docs mention this, btw?) > > It might be a possible way for a social engineering attack, if comments > like the following were inserted: > "Comment: NOTE: I will retire my current key soon!" > "Comment: Obtain my new key from http://evil.impersonator.net/sven.asc" > "Comment: Fingerprint of new key: [...]" > > It may not be a big risk, but I doubt that the general user-base is > aware of the fact that comments are not signed parts of the message. > I would suggest to at least update the documentation :-) > > cu, Sven This is a good point I hadn't even considered. I only thought about the opportunity for an attacker to insert whatever text he chose to make it look like it came from the sender. For example -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 To Her Majesty The Queen, Thanks very much indeed for the lovely dinner you made for our staff. It was vital that we were able to receive assistance on (insert matter of diplomatic importance) Your Obedient Servant, The Prime Minister -----BEGIN PGP SIGNATURE----- Comment: Your chef is a bloody menace! The entire staff spent the remainder of Comment: the evening in the loo and nothing at all was accomplished the following Comment: day. If you plan another event such as that you would do well to Comment: consider not inviting us at all! Comment: pm at houseoflords.com Comment: p.s. it's too late for apologies! ljhl sjilu745pfo98h09j7ofj876ljhl sjilu745pfo98h09j7ofj876ljhl sjilu745pfo98h09j7ofj876 yfot874267fo8fnv98y070760870n7b87yfot874267fo8fnv98y070760870n7b87yfot87426 876ljhl sjilu745pfo98h09j7ofj8876ljhl sjilu745pfo98h09j7ofj8876ljhl sjilu745pfo98h09j7o -----END PGP SIGNATURE----- From randux at Safe-mail.net Mon Apr 2 11:40:18 2007 From: randux at Safe-mail.net (randux at Safe-mail.net) Date: Mon, 2 Apr 2007 12:40:18 +0300 Subject: comment and version fields. Message-ID: -------- Original Message -------- From: "Robert J. Hansen" Cc: GnuPG users Subject: Re: comment and version fields. Date: Sun, 1 Apr 2007 15:05:37 -0500 > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > > fields. I suppose its futile to try to change a standard but it > > seems that it might be very damaging indeed to have a signed > > message altered after signing. That seems to defeat the reason for > > signing as the common person would assume that a signed message is > > protected entirely against unauthorised changes. > > The signed message _is_ protected entirely against unauthorized > changes. Or, rather, as close to "entirely" as you can get with our > current level of cryptography. > > The signature block is just a private-key encryption of the digest of > the message, plus a few additional bits of information of use to > OpenPGP. That private-key encryption of the digest of the message is > the signature. Everything else is, to some degree, irrelevant, with > some things being more irrelevant than others. > > If you alter a comment field, you're not altering either the original > message nor the private-key encryption of the digest of the message. > So what's the complaint? How is this tampering with the signature > scheme? > > > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.7 (Darwin) > Comment: only an idiot would think this is a problem! > Comment: go post your problems on /dev/null!!! > > iQEcBAEBCAAGBQJGEBCSAAoJELcA9IL+r4EJzS4IANXJtvWSKnxWBA4oowoyaRtG > QrQGSv1LQJ9sreJ0c+GmxTF8K9Hi+gTRPeoIy5NUN4HJV5x+TbxmkTpO1QvcVsgN > DfZYYf3sZugMOIdzQzbp0F63Z0SAV2Lz4NtRMiD6HflvQHovdE0V8k6M6G23XvcY > QLstIn+XMRWBdIXX2zE7RZxNGY73TOSobNI0lDcjMyoBrSkMSdkJ4QdJv07ChI5t > 5X+/mwpdh4KU41DE/osuqwcV/vUCqJ7+EKhdKlvHNqlhWMvJnabL3ssvopgTU9yv > 1oqLR14toInTrUZGJ8mxkEmzdDKRm53qEfGKEmmsTNS0w5QBUgDRBOJY3ZgDis4= > =8OOA > -----END PGP SIGNATURE----- I think it's a bit worse on a clearsigned document such as your post for example. BTW There wasn't any need for name calling! ;) Rand p.s. of course I've altered his clearsigned post in this example. But it would still verify properly. This is my point. From rjh at sixdemonbag.org Mon Apr 2 16:46:12 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Mon, 2 Apr 2007 09:46:12 -0500 Subject: comment and version fields. In-Reply-To: References: Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > p.s. of course I've altered his clearsigned post in this example. > But it would still > verify properly. This is my point. This is a nonissue. I can't think of a stronger way to put it. The mutability of the comment and version string is well known and clearly documented in the RFC. If you wish to use a tool, you are responsible for knowing the operation of that tool. If you wish to be ignorant, you will remain forever exploitable. There is no technological cure for this. All technological attempts to cure this are doomed to fail. For every human-factors problem there exist technological solutions which are cheap, easy and wrong. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iQEcBAEBCAAGBQJGERc1AAoJELcA9IL+r4EJEgEIAONnqma05JYq7phSi85pCaPO 0z0DHlAzAbgyYWB410aLEJvWhV1kW7g8FpMUxayTEk4Le8fS4i2tj10v3YrEta3N viQ7yoYRDKUTTRD0TnpfUr+pjGvBEpgE4eEm+uzF7Gw961u71SgwCJtKwzvCy3f/ BeLLVsv8mWaC6m+iNCm1ICUEUOv32mN1TgTCNa0l+XCupP8z1qFkJb7919kGEU7r 3g/bxJ+u/ZNjIZcykCN5E7mTF9bYE3C8PjyNIpkBs7U5yLpsjtsGkSB04sOB2p4R Rw+zfYAQtxerva721zHOU0XlXd82Ny5WhYY1tJ7EB4+gbhgTFCUGljSDnu/fUcg= =StmC -----END PGP SIGNATURE----- From randux at Safe-mail.net Mon Apr 2 17:15:45 2007 From: randux at Safe-mail.net (randux at Safe-mail.net) Date: Mon, 2 Apr 2007 18:15:45 +0300 Subject: comment and version fields. Message-ID: -------- Original Message -------- From: "Robert J. Hansen" Cc: GnuPG users Subject: Re: comment and version fields. Date: Mon, 2 Apr 2007 09:46:12 -0500 > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > > p.s. of course I've altered his clearsigned post in this example. > > But it would still > > verify properly. This is my point. > > This is a nonissue. I can't think of a stronger way to put it. The > mutability of the comment and version string is well known and > clearly documented in the RFC. > > If you wish to use a tool, you are responsible for knowing the > operation of that tool. If you wish to be ignorant, you will remain > forever exploitable. There is no technological cure for this. All > technological attempts to cure this are doomed to fail. > > For every human-factors problem there exist technological solutions > which are cheap, easy and wrong. > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.7 (Darwin) > > iQEcBAEBCAAGBQJGERc1AAoJELcA9IL+r4EJEgEIAONnqma05JYq7phSi85pCaPO > 0z0DHlAzAbgyYWB410aLEJvWhV1kW7g8FpMUxayTEk4Le8fS4i2tj10v3YrEta3N > viQ7yoYRDKUTTRD0TnpfUr+pjGvBEpgE4eEm+uzF7Gw961u71SgwCJtKwzvCy3f/ > BeLLVsv8mWaC6m+iNCm1ICUEUOv32mN1TgTCNa0l+XCupP8z1qFkJb7919kGEU7r > 3g/bxJ+u/ZNjIZcykCN5E7mTF9bYE3C8PjyNIpkBs7U5yLpsjtsGkSB04sOB2p4R > Rw+zfYAQtxerva721zHOU0XlXd82Ny5WhYY1tJ7EB4+gbhgTFCUGljSDnu/fUcg= > =StmC > -----END PGP SIGNATURE----- No, you're misunderstanding me. I'm not concerned with the technical user who posts a question to a news list and understands the issue. I'm wondering about the non-technical (business) user who gets a plug-in for his email client and then misinterprets a modified signature block that someone tampered with. From rjh at sixdemonbag.org Mon Apr 2 17:46:17 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Mon, 2 Apr 2007 10:46:17 -0500 Subject: comment and version fields. In-Reply-To: References: Message-ID: > No, you're misunderstanding me. I'm not concerned with the > technical user who posts a question to a news list and understands > the issue. I'm wondering about the non-technical (business) user > who gets a plug-in for his email client and then misinterprets a > modified signature block that someone tampered with. Then this isn't even a GnuPG problem, is it? Find an email client and plugin which makes this sort of thing possible, and then go complain to them. From wk at gnupg.org Mon Apr 2 17:34:07 2007 From: wk at gnupg.org (Werner Koch) Date: Mon, 02 Apr 2007 17:34:07 +0200 Subject: comment and version fields. In-Reply-To: (randux@Safe-mail.net's message of "Mon\, 2 Apr 2007 18\:15\:45 +0300") References: Message-ID: <87ps6myemo.fsf@wheatstone.g10code.de> On Mon, 2 Apr 2007 17:15, randux at Safe-mail.net said: > No, you're misunderstanding me. I'm not concerned with the technical > user who posts a question to a news list and understands the > issue. I'm wondering about the non-technical (business) user who > gets a plug-in for his email client and then misinterprets a > modified signature block that someone tampered with. Proper MUAs clearly mark the signed part(s) of a message. For instance, checkout KMail (or Gnus). Salam-Shalom, Werner From r.post at sara.nl Mon Apr 2 17:25:44 2007 From: r.post at sara.nl (Remco Post) Date: Mon, 2 Apr 2007 17:25:44 +0200 Subject: comment and version fields. In-Reply-To: References: Message-ID: <46112078.2080106@sara.nl> Robert J. Hansen wrote: >> p.s. of course I've altered his clearsigned post in this example. >> But it would still >> verify properly. This is my point. > > This is a nonissue. I can't think of a stronger way to put it. The > mutability of the comment and version string is well known and > clearly documented in the RFC. > > If you wish to use a tool, you are responsible for knowing the > operation of that tool. If you wish to be ignorant, you will remain > forever exploitable. There is no technological cure for this. All > technological attempts to cure this are doomed to fail. > > For every human-factors problem there exist technological solutions > which are cheap, easy and wrong. > > I partly agree, this is a human problem, that is, the human being to much exposed to the workings of the protocol. To me (a simple human being) I want to know just one thing: did this message come unaltered from the person who claims to have send it (signature), and can anybody but the intended recepients read it (encrypted). Now as how openpgp accomplishes this is not my problem, I don't want to know anything about it. Version and Comment fiellds are not part of the message, so I should not see them... -- Met vriendelijke groeten, Remco Post SARA - Reken- en Netwerkdiensten http://www.sara.nl High Performance Computing Tel. +31 20 592 3000 Fax. +31 20 668 3167 PGP Key fingerprint = 6367 DFE9 5CBC 0737 7D16 B3F6 048A 02BF DC93 94EC "I really didn't foresee the Internet. But then, neither did the computer industry. Not that that tells us very much of course - the computer industry didn't even foresee that the century was going to end." -- Douglas Adams From kloecker at kde.org Mon Apr 2 23:07:14 2007 From: kloecker at kde.org (Ingo =?iso-8859-1?q?Kl=F6cker?=) Date: Mon, 02 Apr 2007 23:07:14 +0200 Subject: comment and version fields. In-Reply-To: <87ps6myemo.fsf@wheatstone.g10code.de> References: <87ps6myemo.fsf@wheatstone.g10code.de> Message-ID: <200704022307.17760@erwin.ingo-kloecker.de> On Monday 02 April 2007 17:34, Werner Koch wrote: > On Mon, 2 Apr 2007 17:15, randux at Safe-mail.net said: > > No, you're misunderstanding me. I'm not concerned with the > > technical user who posts a question to a news list and understands > > the issue. I'm wondering about the non-technical (business) user > > who gets a plug-in for his email client and then misinterprets a > > modified signature block that someone tampered with. > > Proper MUAs clearly mark the signed part(s) of a message. For > instance, checkout KMail (or Gnus). Moreover, at least in KMail the comment and version headers are not even shown to the user. So there's no way the user could be lead into thinking they belonged to the signed text/data. Regards, Ingo -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: not available Url : /pipermail/attachments/20070402/2086c033/attachment.pgp From yaverot at nerdshack.com Tue Apr 3 17:57:25 2007 From: yaverot at nerdshack.com (Matt) Date: Tue, 03 Apr 2007 09:57:25 -0600 Subject: comment and version fields. [Long] In-Reply-To: References: Message-ID: <46127965.4060907@nerdshack.com> Robert J. Hansen wrote: > This is a nonissue. I can't think of a stronger way to put it. The > mutability of the comment and version string is well known and > clearly documented in the RFC. It is well known to people who have followed PGP & GPG for years, some who didn't watch as well will see that this 'flaw' has been patched on multiple occasions so it is nothing to worry about. Its in the RFC? Should I quote Arthur Dent about where the plans to destroy his home were hidden, when such a notice should have been mailed to his home? Now I haven't read the OpenPGP RFC, but if it is anything like the other RFCs that I've looked at (but been unable to read) its language is the worst possible combination between a lawyer and an engineer. Designed to kill all interest in the subject before getting down to the subject. Now I just double checked, but the RFC wasn't included as the documentation of the last GPG release I received. There are man pages, which can't be read under windows, and there isn't a manual. I assume if I got GPG more directly, the manual would be included, but I didn't want install problems and used ThunderbirdPortable, so perhaps that distributor removed that documentation. > If you wish to use a tool, you are responsible for knowing the > operation of that tool. I buy a drill, I know a hand crank or motor turns the bit, and the bit makes holes. I buy a refrigerator, its job is to keep food cool, I have now idea how it turns electricity into cooling - and it is not addressed in the manual, as long as it does its job it doesn't matter. I have a tool I use to get to work each day, it is called a car. I have the faintest and most basic understanding of an internal combustion engine, but have no idea why a muffler reduces pollution so my vehicle passes emissions tests. I download 7-zip, and use it to compress and decompress data, do I understand how each compression and decompression work? No. When I look at the manual, does it tell me how to compress and decompress by hand? Or does it tell me what non-free programs it makes obsolete? Even if it started to tell me how to (de)compress, would it explain the phrase 'dynamic hash table'? I download GPG. Does the manual explain how each encryption/signing algorithm works? Or does it say it supports RSA, DH, AES... possibly mentioning limitation of each choice? Or does it assume that such details are unimportant as long as the user gets "gpg -e -r heine file"? Does it say that the comment lines I read in the (clearsigned) message before running it through GPG are not part of the signed message, that any third party between the sender and me could have altered them? > For every human-factors problem there exist technological solutions > which are cheap, easy and wrong. Which explains airport security. If the RFC had been made to have the comments above the " --- BEGIN" line, or made it so that it started "--- Begin PGP Message" had comments (and hash) then "--- begin signed" so that the comments are clearly indicated outside the signed area, this wouldn't be a problem. Okay, it would be less of a problem, but clearly showing the signed portion is everything within the beginning and ending markers (and only that within the markers) is the obvious way people think. Instead of an answer along the lines of 'It is not in the manual, but mentioned in some obscure document surrounded by many incomprehensible documents says that lines before the first double enter (normally just "comment" and "hash" lines) are not part of the signed content, and are meant to be informational to either the OpenPGP client, or those without a client so they can become informed'. Fixing the RFC is probably not an option, but being more clear in user documentation is. Not just the official GnuPG manual, but the OpenPGP help file in enigmail, and other MUA wrappers. From rjh at sixdemonbag.org Tue Apr 3 20:55:12 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Tue, 3 Apr 2007 13:55:12 -0500 Subject: comment and version fields. [Long] In-Reply-To: <46127965.4060907@nerdshack.com> References: <46127965.4060907@nerdshack.com> Message-ID: <535D1742-4CBD-40D8-A0D1-DAA758CF95BA@sixdemonbag.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Does it say that the comment lines I read > in the (clearsigned) message before running it through GPG are not > part > of the signed message, that any third party between the sender and me > could have altered them? I would think the line "----- BEGIN PGP SIGNATURE -----" would be a tipoff to the fact that the signed portion of the message has ended and data meant for an OpenPGP application's internal use is now beginning. Thus, yes, I do think it's flamingly obvious that anything in the signature block is not part of the signed message. > wouldn't be a problem. Okay, it would be less of a problem, but > clearly > showing the signed portion is everything within the beginning and > ending > markers (and only that within the markers) is the obvious way people > think. Which is the entire reason why we have those "----- BEGIN" lines. So that people can see the markers delineating which portions of the message are protected. As has been repeated here ad nauseam, this is not a GnuPG problem. This is not a PGP problem. This is not an RFC problem. This is, at best, an MUA problem and should be brought up with MUA authors who present signed data in a format that makes it easy to mistake things. Please, if you want to continue to beat this drum, please beat it in front of the right people. > Fixing the RFC is probably not an option, but being more clear in user > documentation is. Not just the official GnuPG manual, but the OpenPGP > help file in enigmail, and other MUA wrappers. Then take it up on the Enigmail list. This is the GnuPG-Users list. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iQEcBAEBCAAGBQJGEqMRAAoJELcA9IL+r4EJALsIALe/MDIDNEeNsoMmd3bKh/lV qQZQjK/keV98AEPfkKYw0rYnH9uyc63FIRTth3o3PeF0fG+Vw5RFXDvi6tSS96wn 7w8qdasETHOazm4Lz34oEEqswTCYJWQGnVWYyktmtHLPhouWIR+wkx0pmlFiZc+i rv6FiOXzTdPZJg578U0nu3qsr5muvuJB56COjlG67tqdWLslZ4DKTl+ErF1Twlyk KypG3J/n/dyLOX2P/NN+JvyTd19b0PGOFDkFi3dff0k8tDeJKPfpjt83s5jtcIrN XjDEgQ+l7Z4ridfabNdZar0tn9c/hpXY35a+trLx+UgIKUXzD9Mgd/PiR23+KI8= =SD3N -----END PGP SIGNATURE----- From tmz at pobox.com Tue Apr 3 21:33:14 2007 From: tmz at pobox.com (Todd Zullinger) Date: Tue, 3 Apr 2007 15:33:14 -0400 Subject: comment and version fields. [Long] In-Reply-To: <46127965.4060907@nerdshack.com> References: <46127965.4060907@nerdshack.com> Message-ID: <20070403193314.GH28837@psilocybe.teonanacatl.org> Matt wrote: > Now I haven't read the OpenPGP RFC, but if it is anything like the other > RFCs that I've looked at (but been unable to read) its language is the > worst possible combination between a lawyer and an engineer. Designed to > kill all interest in the subject before getting down to the subject. Yes, you've found the true purpose of all RFCs. Unfortunately they aren't working as intended as numerous folks have managed to glean just enough detail out of them to make working implementations based on these documents. :) > Now I just double checked, but the RFC wasn't included as the > documentation of the last GPG release I received. Nor should it be. As an end user of the software you shouldn't need to know the details of implementation. And unless you have buggy software that mixes the comment field in with the signed data, there isn't really any problem here. > There are man pages, which can't be read under windows Not that I take much glee in knowing there are things I can read on linux that Windows users can't, but I thought that the man pages were generally included with the windows builds and you could open them with a text editor. But it's been a long time since I even looked at a windows box with gpg installed. > Does it say that the comment lines I read in the (clearsigned) > message before running it through GPG are not part of the signed > message, that any third party between the sender and me could have > altered them? If you're not comfortable with the tool, then that's why there are many convenient wrappers/plugins that handle this automatically. I think it seems reasonable to assume that if you're running things through gpg manually, on the command-line, that you ought to have a little more understanding of the tool. > Fixing the RFC is probably not an option, but being more clear in > user documentation is. Not just the official GnuPG manual, but the > OpenPGP help file in enigmail, and other MUA wrappers. Since enigmail doesn't even show you the comment field, why would anything need to be added to its help file about it? Ditto for most of the other mail plugins that I've seen and used. -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ====================================================================== I never forget a face, but in your case I'll be glad to make an exception. -- Groucho Marx -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 607 bytes Desc: not available Url : /pipermail/attachments/20070403/e76cefd6/attachment-0001.pgp From srydzews at gmail.com Tue Apr 3 22:23:55 2007 From: srydzews at gmail.com (Stan Rydzewski) Date: Tue, 3 Apr 2007 16:23:55 -0400 Subject: comment and version fields. [Long] In-Reply-To: <20070403193314.GH28837@psilocybe.teonanacatl.org> References: <46127965.4060907@nerdshack.com> <20070403193314.GH28837@psilocybe.teonanacatl.org> Message-ID: > Not that I take much glee in knowing there are things I can read on > linux that Windows users can't, but I thought that the man pages were > generally included with the windows builds and you could open them > with a text editor. Yes. They don't format as nicely, but you can read them. In any case there's a PDF of the current version. From randux at Safe-mail.net Tue Apr 3 23:41:42 2007 From: randux at Safe-mail.net (randux at Safe-mail.net) Date: Wed, 4 Apr 2007 00:41:42 +0300 Subject: no, it's not an email client problem, it's what I said at the start Message-ID: >From: Robert J. Hansen >Subject: Re: comment and version fields. >Date: 2007-04-02 15:46:17 GMT (1 day, 5 hours and 41 minutes ago) >>From: Randux >> No, you're misunderstanding me. I'm not concerned with the >> technical user who posts a question to a news list and understands >> the issue. I'm wondering about the non-technical (business) user >> who gets a plug-in for his email client and then misinterprets a >> modified signature block that someone tampered with. > >Then this isn't even a GnuPG problem, is it? > >Find an email client and plugin which makes this sort of thing >possible, and then go complain to them. It's either a GnuPG problem or an RFC problem. It's possible to add or remove or modify text in a clearsigned message. If that's what the RFC allows, then the RFC is broken. If the RFC doesn't allow it then GnuPG is broken. Why all the excuses and flaring tempers...have I insulted anyone? This kind of sloppy exposure is out of place in the product/RFC. Making excuses or trying to explain around it or blame it on email clients is silly and not fooling anyone. Thanks to Werner and everyone else who works on GnuPG. Cheers, Rand Cheers to all, Rand From r.post at sara.nl Wed Apr 4 00:10:06 2007 From: r.post at sara.nl (Remco Post) Date: Wed, 04 Apr 2007 00:10:06 +0200 Subject: comment and version fields. [Long] In-Reply-To: <535D1742-4CBD-40D8-A0D1-DAA758CF95BA@sixdemonbag.org> References: <46127965.4060907@nerdshack.com> <535D1742-4CBD-40D8-A0D1-DAA758CF95BA@sixdemonbag.org> Message-ID: <4612D0BE.2060105@sara.nl> Robert J. Hansen wrote: >> Does it say that the comment lines I read >> in the (clearsigned) message before running it through GPG are not >> part >> of the signed message, that any third party between the sender and me >> could have altered them? > > I would think the line "----- BEGIN PGP SIGNATURE -----" would be a > tipoff to the fact that the signed portion of the message has ended > and data meant for an OpenPGP application's internal use is now > beginning. Thus, yes, I do think it's flamingly obvious that > anything in the signature block is not part of the signed message. > Now, this is true for you and me. Now, take my secretary as an example. She has not installed any pgp/gpg aware software, nor is she an experienced user of cryptographic tools. Do you expect her to correctly interpret these hints? I don't. Now, usually I don't sign messages to people who can't do anything with those signatures to prevent confusion. > > Which is the entire reason why we have those "----- BEGIN" lines. So > that people can see the markers delineating which portions of the > message are protected. > > As has been repeated here ad nauseam, this is not a GnuPG problem. > This is not a PGP problem. This is not an RFC problem. This is, at > best, an MUA problem and should be brought up with MUA authors who > present signed data in a format that makes it easy to mistake things. > So now it's blame somebody else? I guess that comments might not be the best idea for the rfc/protocol. Do they serve any purpose in the protocol? No? So maybe they are a problem in the protocol after al. IMNSHO, the comments taint the very purpose of the digital signature. Now as to this being the right mailinglist, this list is for discussions amongst users of gnupg for discussions about the problems they see in the use of gnupg. Yes in an ideal world all MUAs allways hide all gnupg internals for all users all of the time. I guess you are now volunteering to start convincing the people in Redmont? In the mean time, maybe it's easier to think about what the protocol is intended to do and conclude that maybe a comment field is not very useful, and could be counterproductive. (ps, if I want something to be part of a message, I can put it in the signed part of the message just as well... eg. my sig.) -- Met vriendelijke groeten, Remco Post SARA - Reken- en Netwerkdiensten http://www.sara.nl High Performance Computing Tel. +31 20 592 3000 Fax. +31 20 668 3167 PGP Key fingerprint = 6367 DFE9 5CBC 0737 7D16 B3F6 048A 02BF DC93 94EC "I really didn't foresee the Internet. But then, neither did the computer industry. Not that that tells us very much of course - the computer industry didn't even foresee that the century was going to end." -- Douglas Adams From rjh at sixdemonbag.org Wed Apr 4 00:20:29 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Tue, 03 Apr 2007 17:20:29 -0500 Subject: comment and version fields. [Long] In-Reply-To: <4612D0BE.2060105@sara.nl> References: <46127965.4060907@nerdshack.com> <535D1742-4CBD-40D8-A0D1-DAA758CF95BA@sixdemonbag.org> <4612D0BE.2060105@sara.nl> Message-ID: <4612D32D.4020904@sixdemonbag.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Remco Post wrote: > Now, this is true for you and me. Now, take my secretary as an example. > She has not installed any pgp/gpg aware software, nor is she an > experienced user of cryptographic tools. Do you expect her to correctly > interpret these hints? _Hints_? I'm sorry, at this point I can't take this discussion seriously. Calling these things "hints" is like saying "a red octagonal road sign with the word STOP written on it is a hint that you should decrease your velocity to zero". While true, nobody would ever say it. Nor would anyone say that it's the car's fault you drove through a stop sign because you couldn't be bothered to learn the semantics associated with the stop sign. > So now it's blame somebody else? No. This is "go talk to the correct people". This is not a GnuPG issue. > volunteering to start convincing the people in Redmont? In the mean > time, maybe it's easier to think about what the protocol is intended to > do and conclude that maybe a comment field is not very useful, and could > be counterproductive. If that's what you want to do, then join the IETF OpenPGP working group and start talking about it there. Talking about it here will not change a blessed thing. Talking about it there might actually achieve something. The IETF OpenPGP WG and the various mailing lists for the various MUAs are the right place to be discussing this issue. Not here. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBCgAGBQJGEtMtAAoJELcA9IL+r4EJXWoIAKTlE2jDVoe7XmzbKydkyTnh J4Yma2Vlurc0mmGDn6o8/6pTKCRhtbxOMCZyUIq7oQTsVGImMDj7Ezj0vLnn4LPQ lJpVDVfht6Stbp51Cxwd2Tp0AXgAnXzntctbJngEnfAj2eZcLARsurpMiJX5d7SE y8PSZyHrDzEApDb6DtKRadPFmaVRotSes3KXfS6DGRmmG099xLm2GopMly7LERSs NPHdcXUtxXC/kcYskbUUkbbnPJdOu4KOtyLRp6lFmmMRmAM75KTclMhyMYSMLT0I zftDnjDlMvsB4w1IMUoiwKRS5FJRzZTOqkt7cSY19nOq0KvAtEPuOTZhbA4Ei8Y= =R8Vb -----END PGP SIGNATURE----- From rjh at sixdemonbag.org Wed Apr 4 00:30:59 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Tue, 03 Apr 2007 17:30:59 -0500 Subject: no, it's not an email client problem, it's what I said at the start In-Reply-To: References: Message-ID: <4612D5A3.5020106@sixdemonbag.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 randux at Safe-mail.net wrote: > It's either a GnuPG problem or an RFC problem. It's a GnuPG bug if and only if it is not behavior specified by the RFC. Given that GnuPG is correctly implementing the RFC here, that means--drumroll, please--it is not a bug in GnuPG. Nor, for reasons I've already explained, is it a bug in the RFC. Although if you want to continue to argue that it is, please take it to the IETF OpenPGP working group mailing list. Beating the dead horse here will do nothing except give the poor beast postmortem bruising. The IETF OpenPGP WG mailing list is the place where change can actually happen. > It's possible to add > or remove or modify text in a clearsigned message. It is not feasible to undetectably remove, add, or modify text in a clearsigned message. Your example adds, modifies, etc., text in the _signature_. The _message_ remains protected. > Why all the excuses and flaring tempers...have I insulted anyone? I have explained this in clear English several times. This is not a GnuPG bug; this is not an RFC bug; this is not something the developers need to fix; this is, at best, an issue for the IETF OpenPGP WG and the mailing lists for the various MUAs. Please take it there. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBCgAGBQJGEtWiAAoJELcA9IL+r4EJdREIAJrixtwqWkyM1G1HKpJ8t4xi 6N1pXI7Z4UKYxe6HMIzLQLO32WzHjy5323Z3V7culwngRqYiguFff7Vh1XQGClIW XoxB5GxSMeMRDvaLdYhaZq9vyZHNFyQTWI8aWzkZxe9mBzFt4X0ngcsUpC65/Xmy ZqVmBwpOYvWiofBK9nFG+DXZQ+iL95qc8CDa+9a3cBUEP+0RVNr2HGi0HZAqW6Jo SKPVs3lpN4FIkNk5WWv3KCgPtFAMdI8U/N+6SKQri+4ZE78ty4sq0Zu0AH//8jzV au9gRsny++JgOS26mIvbirwWCAy66gvnr3Nvf9bFFKL9E7kLYl+RnqUzJWRgMAU= =KgXV -----END PGP SIGNATURE----- From tmz at pobox.com Wed Apr 4 00:49:07 2007 From: tmz at pobox.com (Todd Zullinger) Date: Tue, 3 Apr 2007 18:49:07 -0400 Subject: no, it's not an email client problem, it's what I said at the start In-Reply-To: References: Message-ID: <20070403224907.GN28837@psilocybe.teonanacatl.org> randux at Safe-mail.net wrote: > It's either a GnuPG problem or an RFC problem. It could also be a PEBKAC. :) > It's possible to add or remove or modify text in a clearsigned > message. If that's what the RFC allows, then the RFC is broken. If > the RFC doesn't allow it then GnuPG is broken. It is neither. You can change a comment field which is not used for any cryptographic purpose. This is not a GnuPG problem, therefore by your logic it must be a problem with the RFC. In that case, please direct further mail to the openpgp working group. > This kind of sloppy exposure is out of place in the product/RFC. > Making excuses or trying to explain around it or blame it on email > clients is silly and not fooling anyone. Perhaps the comment field should simply be renamed to "this is only a comment, it's not part of the signed message so you shouldn't infer that it is secured:". Or, if you don't like the comment field, don't set it in your gpg config. -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ====================================================================== It seems such a pity that Noah and his party did not miss the boat. -- Mark Twain -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 542 bytes Desc: not available Url : /pipermail/attachments/20070403/73a45345/attachment.pgp From JPClizbe at tx.rr.com Wed Apr 4 01:34:24 2007 From: JPClizbe at tx.rr.com (John Clizbe) Date: Tue, 03 Apr 2007 18:34:24 -0500 Subject: comment and version fields. [Long] In-Reply-To: <535D1742-4CBD-40D8-A0D1-DAA758CF95BA@sixdemonbag.org> References: <46127965.4060907@nerdshack.com> <535D1742-4CBD-40D8-A0D1-DAA758CF95BA@sixdemonbag.org> Message-ID: <4612E480.7000202@tx.rr.com> Robert J. Hansen wrote: > Matt wrote: > > Please, if you want to continue to beat this drum, please beat it in > front of the right people. > >> Fixing the RFC is probably not an option, but being more clear in user >> documentation is. Not just the official GnuPG manual, but the OpenPGP >> help file in enigmail, and other MUA wrappers. That is the beauty of open source. If one sensea a deficiency, he may either sit on the sidelines bleating and whining or he may submit updates and changes to the project documentation to make it better. > Then take it up on the Enigmail list. This is the GnuPG-Users list. Rob, I know you know better. Enigmail brackets signed text between ********* *BEGIN ENCRYPTED or SIGNED PART* ********* and ********** *END ENCRYPTED or SIGNED PART* ********** markers -- John P. Clizbe Inet: John (a) Mozilla-Enigmail.org You can't spell fiasco without SCO. PGP/GPG KeyID: 0x608D2A10/0x18BB373A "what's the key to success?" / "two words: good decisions." "what's the key to good decisions?" / "one word: experience." "how do i get experience?" / "two words: bad decisions." "Just how do the residents of Haiku, Hawai'i hold conversations?" -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 663 bytes Desc: OpenPGP digital signature Url : /pipermail/attachments/20070403/ad333f8d/attachment.pgp From dshaw at jabberwocky.com Wed Apr 4 01:55:43 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Tue, 3 Apr 2007 19:55:43 -0400 Subject: comment and version fields. In-Reply-To: References: Message-ID: <20070403235543.GA1606@jabberwocky.com> On Mon, Apr 02, 2007 at 12:40:18PM +0300, randux at Safe-mail.net wrote: > p.s. of course I've altered his clearsigned post in this > example. But it would still verify properly. This is my point. The premise of the argument is false. You didn't alter his clearsigned post. David From dshaw at jabberwocky.com Wed Apr 4 02:11:11 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Tue, 3 Apr 2007 20:11:11 -0400 Subject: comment and version fields. [Long] In-Reply-To: <46127965.4060907@nerdshack.com> References: <46127965.4060907@nerdshack.com> Message-ID: <20070404001111.GB1606@jabberwocky.com> On Tue, Apr 03, 2007 at 09:57:25AM -0600, Matt wrote: > I buy a drill, I know a hand crank or motor turns the bit, and the bit > makes holes. I buy a refrigerator, its job is to keep food cool, I have > now idea how it turns electricity into cooling - and it is not addressed > in the manual, as long as it does its job it doesn't matter. I have a > tool I use to get to work each day, it is called a car. I have the > faintest and most basic understanding of an internal combustion engine, > but have no idea why a muffler reduces pollution so my vehicle passes > emissions tests. I download 7-zip, and use it to compress and decompress > data, do I understand how each compression and decompression work? No. > When I look at the manual, does it tell me how to compress and > decompress by hand? Or does it tell me what non-free programs it makes > obsolete? Even if it started to tell me how to (de)compress, would it > explain the phrase 'dynamic hash table'? I download GPG. Does the manual > explain how each encryption/signing algorithm works? Or does it say it > supports RSA, DH, AES... possibly mentioning limitation of each choice? > Or does it assume that such details are unimportant as long as the user > gets "gpg -e -r heine file"? Does it say that the comment lines I read > in the (clearsigned) message before running it through GPG are not part > of the signed message, that any third party between the sender and me > could have altered them? This is silly. Observe: Step 1: echo "This is my signed message" | gpg --clearsign > my-signed-message.gpg Step 2: cat my-signed-message.gpg | gpg > output Step 3: cat output This is my signed message Look: no comments or anything like that. You cannot infer any meaning from a signed message before you verify it, and notice that when you verify it, you get exactly what you'd expect. You're basically reading the message "source code" before it has been verified. Complaining about the Comment field is rather like complaining about OpenPGP packet headers. I could hide all sorts of super-sekrit messages in packet headers or in unhashed signature subpackets. It doesn't matter a whit. They're not part of the signed message. > Fixing the RFC is probably not an option, but being more clear in user > documentation is. Not just the official GnuPG manual, but the OpenPGP > help file in enigmail, and other MUA wrappers. The OpenPGP documentation does not really need a note to say that "you need to actually verify a signature before you decide that it is valid". David From JPClizbe at tx.rr.com Wed Apr 4 02:02:01 2007 From: JPClizbe at tx.rr.com (John Clizbe) Date: Tue, 03 Apr 2007 19:02:01 -0500 Subject: comment and version fields. [Long] In-Reply-To: <20070403193314.GH28837@psilocybe.teonanacatl.org> References: <46127965.4060907@nerdshack.com> <20070403193314.GH28837@psilocybe.teonanacatl.org> Message-ID: <4612EAF9.3090505@tx.rr.com> Todd Zullinger wrote: > Matt wrote: > >> There are man pages, which can't be read under windows > > Not that I take much glee in knowing there are things I can read on > linux that Windows users can't, but I thought that the man pages were > generally included with the windows builds and you could open them > with a text editor. But it's been a long time since I even looked at > a windows box with gpg installed. The man pages are furnished as prepared text. If they were not bundled with the GnuPG software, the packager he obtained the software from needs to be taken to task. >> Does it say that the comment lines I read in the (clearsigned) >> message before running it through GPG are not part of the signed >> message, that any third party between the sender and me could have >> altered them? > > If you're not comfortable with the tool, then that's why there are > many convenient wrappers/plugins that handle this automatically. I > think it seems reasonable to assume that if you're running things > through gpg manually, on the command-line, that you ought to have a > little more understanding of the tool. Enigmail brackets signed text between ********* *BEGIN ENCRYPTED or SIGNED PART* ********* and ********** *END ENCRYPTED or SIGNED PART* ********** markers. Those would seem to be a bit obvious. > >> Fixing the RFC is probably not an option, but being more clear in >> user documentation is. Not just the official GnuPG manual, but the >> OpenPGP help file in enigmail, and other MUA wrappers. > > Since enigmail doesn't even show you the comment field, why would > anything need to be added to its help file about it? Ditto for most > of the other mail plugins that I've seen and used. The only way to see the comments in Enigmail is to either, view the message source, or to turn off the default behavior of automatically decrypting ot verifying messages. -- John P. Clizbe Inet: John (a) Mozilla-Enigmail.org You can't spell fiasco without SCO. PGP/GPG KeyID: 0x608D2A10/0x18BB373A "what's the key to success?" / "two words: good decisions." "what's the key to good decisions?" / "one word: experience." "how do i get experience?" / "two words: bad decisions." "Just how do the residents of Haiku, Hawai'i hold conversations?" -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 663 bytes Desc: OpenPGP digital signature Url : /pipermail/attachments/20070403/1f33de2d/attachment.pgp From dshaw at jabberwocky.com Wed Apr 4 02:58:32 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Tue, 3 Apr 2007 20:58:32 -0400 Subject: no, it's not an email client problem, it's what I said at the start In-Reply-To: References: Message-ID: <20070404005832.GC1606@jabberwocky.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Wed, Apr 04, 2007 at 12:41:42AM +0300, randux at Safe-mail.net wrote: > It's either a GnuPG problem or an RFC problem. It's possible to add > or remove or modify text in a clearsigned message. No, it is not. The RFC doesn't allow it. GnuPG doesn't allow it. Nobody allows it. I am clearsigning this message. I challenge you to modify it. I will donate $1,000 US to any charity you like if you succeed. The definition of success is that: a) The signature must still verify correctly and b) The output of the signature verification in step 'a' still contains your modification. Go for it. > Why all the excuses and flaring tempers...have I insulted anyone? I think it's that the mistake you're making has been explained over and over and you're still repeating it. David -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iEYEAREDAAYFAkYS+DgACgkQ4mZch0nhy8nGtACeLQQuKy8wryUU8sjxubf/uuA+ uT4AnjeoAR7/04F6ZA3/SjzqIwAF8u1L =e0CQ -----END PGP SIGNATURE----- From JPClizbe at tx.rr.com Wed Apr 4 03:56:36 2007 From: JPClizbe at tx.rr.com (John Clizbe) Date: Tue, 03 Apr 2007 20:56:36 -0500 Subject: comment and version fields. [Long] In-Reply-To: References: <46127965.4060907@nerdshack.com> <20070403193314.GH28837@psilocybe.teonanacatl.org> Message-ID: <461305D4.8050805@tx.rr.com> Stan Rydzewski wrote: >> Not that I take much glee in knowing there are things I can read on >> linux that Windows users can't, but I thought that the man pages were >> generally included with the windows builds and you could open them >> with a text editor. > > Yes. They don't format as nicely, but you can read them. In any case > there's a PDF of the current version. Yeah, they sure don't. This is the start of the file, gpg.man, from one of my Windows systems. ================================================ gpg(1) gpg(1) NAME gpg -- encryption and signing tool SYNOPSIS gpg [--homedir name] [--options file] [options] command [args] DESCRIPTION gpg is the main program for the GnuPG system. This man page only lists the commands and options available. For more verbose documentation get the GNU Privacy Handbook (GPH) or one of the other documents at http://www.gnupg.org/documentation/ . Please remember that option parsing stops as soon as a non option is encountered, you can explicitly stop option parsing by using the spe- cial option "--". -- John P. Clizbe Inet: John (a) Mozilla-Enigmail.org You can't spell fiasco without SCO. PGP/GPG KeyID: 0x608D2A10/0x18BB373A "what's the key to success?" / "two words: good decisions." "what's the key to good decisions?" / "one word: experience." "how do i get experience?" / "two words: bad decisions." "Just how do the residents of Haiku, Hawai'i hold conversations?" -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 663 bytes Desc: OpenPGP digital signature Url : /pipermail/attachments/20070403/84f15aba/attachment.pgp From dan at geer.org Wed Apr 4 03:35:28 2007 From: dan at geer.org (dan at geer.org) Date: Tue, 03 Apr 2007 21:35:28 -0400 Subject: up a creek Message-ID: <20070404013528.1931E1BF9DF@absinthe.tinho.net> Dear gnupg-users, I was using gpg 1.4.1 on Mac OSX 10.3.9. There appears to be a UI bug: if you want to use the "--edit-key" function and you have more than one key with the same name, that the UI will only list and only operate on the one of the list of multiple keys with the same name. Why would you have a key with the same name? If you choose (and I chose) to have expiring keys. The only key the UI will talk about is not the one I want to talk about, and thus begins my problem. I did discover that "--list-keys" allowed me to find the KEYID that I actually wanted, and, further, that I could use the KEYID instead of the name as a value for the "--edit-key" function. What I then did was to extend the life of the relevant key ("expire") by one year. Unfortunately, this seemed to get me into a sort of half-state: =============================================== % gpg --edit-key FDE5027B gpg (GnuPG) 1.4.1; Copyright (C) 2005 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details. Secret key is available. pub 1024D/67BFF798 created: 2006-01-20 expires: 2008-03-27 usage: CS trust: ultimate validity: ultimate sub 2048g/FDE5027B created: 2006-01-20 expired: 2007-01-20 usage: E [ultimate] (1). Dan Geer =============================================== Note the different expire dates between keys in the above. I'm guessing that expiring keys is an infrequently used part of the code base. Now this led me to ask at macgpg.sourceforge.net if I was correct. There I got the advice to not use 1.4.1 but to download and build 1.4.7. That was not hard and not scary, though the front page instructions do say that for binary downloads 1.4.7 is only for Mac OSX 10.4.x, and the 1.4.1 was the latest binary for 10.3.9. Nevertheless, after confirming that a build of 1.4.7 was appropriate for 10.3.9, I did as suggested, and downloaded and built according to directions, including getting passing grades on all 27 tests that are done with "make check -i". Therefore, and consistent with the instructions, I did "sudo make install". I then ran this as my very first instruction: % gpg --list-key gpg: fatal: can't create directory `/Users/geer/.gnupg': File exists secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768 and, somewhat disastrously, I appear now to have no keyfiles. Consulting with the macgpg folks again, they found the above hard to imagine; in particular the error message indicated that a file exists in my homedir named .gnupg; not a directory but a file. While they found this odd and inexplicable, that much at least was understandable: ~/.gnupg is and was a symlink to a directory in an encrypted volume. % ls -l ~/.gnupg lrwx------ 1 geer ... /Users/geer/.gnupg@ -> /Volumes/private2/dg/.gnupg/ % ls -l /Volumes/private2/dg/.gnupg ls: /Volumes/private2/dg/.gnupg: No such file or directory In other words, it appears that the install process or the first-run command to --list-keys destroyed the contents in the encrypted volume, not the symlink itself. The macgpg folks found that situation to be so unexpected that they said I should join this list and ask about my situation here. Yes, there is a backup on a token device that is hidden in another location, so the keys are not really and truly lost, but while they may not be lost I am surely lost and ask to be found. Advice? --dan, first time poster From dshaw at jabberwocky.com Wed Apr 4 07:12:20 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Wed, 4 Apr 2007 01:12:20 -0400 Subject: up a creek In-Reply-To: <20070404013528.1931E1BF9DF@absinthe.tinho.net> References: <20070404013528.1931E1BF9DF@absinthe.tinho.net> Message-ID: <20070404051220.GE1606@jabberwocky.com> You have quite a few questions here. I'll answer them as they come up inline. On Tue, Apr 03, 2007 at 09:35:28PM -0400, dan at geer.org wrote: > > Dear gnupg-users, > > I was using gpg 1.4.1 on Mac OSX 10.3.9. There > appears to be a UI bug: if you want to use the > "--edit-key" function and you have more than one key > with the same name, that the UI will only list and > only operate on the one of the list of multiple keys > with the same name. > > Why would you have a key with the same name? If you > choose (and I chose) to have expiring keys. The only > key the UI will talk about is not the one I want to > talk about, and thus begins my problem. > > I did discover that "--list-keys" allowed me to find > the KEYID that I actually wanted, and, further, that > I could use the KEYID instead of the name as a value > for the "--edit-key" function. Yes, this is a feature. You can also use the key fingerprint here if you like. > What I then did was to > extend the life of the relevant key ("expire") by one > year. Unfortunately, this seemed to get me into a > sort of half-state: > > =============================================== > % gpg --edit-key FDE5027B > gpg (GnuPG) 1.4.1; Copyright (C) 2005 Free Software Foundation, Inc. > This program comes with ABSOLUTELY NO WARRANTY. > This is free software, and you are welcome to redistribute it > under certain conditions. See the file COPYING for details. > > Secret key is available. > > pub 1024D/67BFF798 created: 2006-01-20 expires: 2008-03-27 usage: CS > trust: ultimate validity: ultimate > sub 2048g/FDE5027B created: 2006-01-20 expired: 2007-01-20 usage: E > [ultimate] (1). Dan Geer > =============================================== > > Note the different expire dates between keys in the > above. I'm guessing that expiring keys is an infrequently > used part of the code base. No, this worked correctly. An OpenPGP "key" is actually multiple keys glued together. Each of these keys has their own independent expiration date, so if you want to change an expiration, you need to specify which key (primary or subkey) you are changing the expiration of. In your case above, if you wanted to change the expiration of the subkey, you'd type "key 1" before "expire". The man page says: expire Change the key expiration time. If a subkey is selected, the expiration time of this subkey will be changed. With no selection, the key expiration of the primary key is changed. Incidentally, since the "identity" of a key is tied to the primary key, it is a fairly common situation to have a primary key that does not expire, but a subkey that does. Then you can keep making subkeys, and letting them expire over time without having to tinker with the primary key. A nice side effect from doing things this way is that the primary key can even be kept offline altogether. > Now this led me to ask at macgpg.sourceforge.net if > I was correct. There I got the advice to not use > 1.4.1 but to download and build 1.4.7. That was not > hard and not scary, though the front page instructions > do say that for binary downloads 1.4.7 is only for > Mac OSX 10.4.x, and the 1.4.1 was the latest binary > for 10.3.9. That's the precompiled binary downloads distributed by the MacGPG project. If you're building it yourself, you can do it on whatever OSX you have. I personally test new releases on 10.3 and 10.4 (both PPC and Intel). > Nevertheless, after confirming that a > build of 1.4.7 was appropriate for 10.3.9, I did as > suggested, and downloaded and built according to > directions, including getting passing grades on all > 27 tests that are done with "make check -i". Don't use '-i'. I'm not sure where that idea got started, but it's just not correct. -i tells make to keep going after a failure, and that's not something you want to do: if there is a failure, best to just stop. (This is just a side comment - I doubt it has anything to do with the problems you had later). > Therefore, and consistent with the instructions, I > did "sudo make install". > > I then ran this as my very first instruction: > > % gpg --list-key > gpg: fatal: can't create directory `/Users/geer/.gnupg': File exists > secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768 I see what happened, but I don't think installing the new GPG did this to you. You had a symlink to a directory, and something removed every file in that directory, and then the directory itself, before GPG ran as above. Aside from calling keyservers, which creates and deletes randomly named temporary directories like "/tmp/gpg-2iSFzk", GPG simply doesn't have any code in it to delete directories: $ find . -name '*.c' | xargs grep rmdir ./g10/exec.c: if(rmdir(info->tempdir)==-1) Are you using some front-end or installer that might have done this? Did you delete your GnuPG 1.4.1 installation before adding the new one? David From wk at gnupg.org Wed Apr 4 10:22:29 2007 From: wk at gnupg.org (Werner Koch) Date: Wed, 04 Apr 2007 10:22:29 +0200 Subject: comment and version fields. [Long] In-Reply-To: <46127965.4060907@nerdshack.com> (yaverot@nerdshack.com's message of "Tue\, 03 Apr 2007 09\:57\:25 -0600") References: <46127965.4060907@nerdshack.com> Message-ID: <87vegc5z22.fsf@wheatstone.g10code.de> On Tue, 3 Apr 2007 17:57, yaverot at nerdshack.com said: > It is well known to people who have followed PGP & GPG for years, some > who didn't watch as well will see that this 'flaw' has been patched on > multiple occasions so it is nothing to worry about. It is not a flaw but a requirement of the standard. With the same reasoning you could complain about the subject of mail or any other mail header is not encrypted (actuaqlly people do that from time to time). Or well, that gpg does not help you against raffic analysis. > Now I haven't read the OpenPGP RFC, but if it is anything like the other > RFCs that I've looked at (but been unable to read) its language is the > worst possible combination between a lawyer and an engineer. Designed to I can't agree here. Except for the copyright notice the OpenPGP RFC is very on topic and does only the language used in the domain of applied cryptography. Compare that to ISOs and decide what is easier for an engineer to understand. > Now I just double checked, but the RFC wasn't included as the > documentation of the last GPG release I received. There are man pages, RFCs are easily available. It just does not make any sense to keep copies of a dozen RFCs used to implement GnuPG. > in the (clearsigned) message before running it through GPG are not part > of the signed message, that any third party between the sender and me > could have altered them? You feed stuff to gpg top sign it and -depending on the used options - gpg creates a signed message in some format and adds some more data (lines of text) to it for its internal purpose. Given clear text signed messages you see your orginal text and thus you can deduce that the comment lines are not part of it. Anyway, proper use of gpg will show you exacly what you signed - even with --clearsign: $ fortune >plain $ cat plain I really hate this damned machine I wish that they would sell it. It never does quite what I want But only what I tell it. $ gpg --clearsign plain.asc $ cat plain.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I really hate this damned machine I wish that they would sell it. It never does quite what I want But only what I tell it. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iEYEARECAAYFAkYTXr8ACgkQYHhOlAEKV+1VmgCgu5Ed8O7s9wBam150DTXOniCa PNoAn2wycvuBgdB9HDUSDJE1a41NhdPj =rvX0 -----END PGP SIGNATURE----- $ gpg x gpg: Signature made Wed Apr 4 10:15:59 2007 CEST using DSA key ID 010A57ED gpg: Good signature from "Werner Koch " gpg: aka "Werner Koch " gpg: aka "Werner Koch" gpg: aka "Werner Koch " $ cat x I really hate this damned machine I wish that they would sell it. It never does quite what I want But only what I tell it. So where do you see a problem? Shalom-Salam, Werner From sven at radde.name Mon Apr 2 10:19:25 2007 From: sven at radde.name (Sven Radde) Date: Mon, 02 Apr 2007 10:19:25 +0200 Subject: comment and version fields. In-Reply-To: References: Message-ID: <4610BC8D.9070800@radde.name> Hi! randux at Safe-mail.net schrieb: > The "comment" and "version" armor fields are both essentially > comments, and are ignored by the OpenPGP protocol. You can change > either of them to whatever you like. > > --- > > ... That seems to defeat the reason for signing > as the common person would assume that a signed message > is protected entirely against unauthorised changes. I agree with randux here. The Comment is within the "---PGP SIGNATURE---" part and I, too, was not aware that it is not protected by anything. (Do the docs mention this, btw?) It might be a possible way for a social engineering attack, if comments like the following were inserted: "Comment: NOTE: I will retire my current key soon!" "Comment: Obtain my new key from http://evil.impersonator.net/sven.asc" "Comment: Fingerprint of new key: [...]" It may not be a big risk, but I doubt that the general user-base is aware of the fact that comments are not signed parts of the message. I would suggest to at least update the documentation :-) cu, Sven From sven at radde.name Wed Apr 4 08:44:32 2007 From: sven at radde.name (Sven Radde) Date: Wed, 04 Apr 2007 08:44:32 +0200 Subject: no, it's not an email client problem, ... In-Reply-To: <4612D5A3.5020106@sixdemonbag.org> References: <4612D5A3.5020106@sixdemonbag.org> Message-ID: <46134950.7060601@radde.name> Hi! Robert J. Hansen schrieb: > It is not feasible to undetectably remove, add, or modify text in a > clearsigned message. > > Your example adds, modifies, etc., text in the _signature_. > > The _message_ remains protected. It should have become clear by the course of the discussion that not everybody is aware of this (arguably) subtle distinction. I assume that it would even less the case for GnuPG users that do not follow this list (i.e. non-geeks, a.k.a. end-users, no offense intended :-). I thought myself to be quite an adept user of GnuPG but did not realize that Comment lines could be freely altered. Congrats to everyone who was actively aware of the fact before this discussion was brought up here, but, IMHO, said group would have been limited to the developers or other deeply involved people. On the other hand, the implications of this are not so serious as to make a huge fuss about it. I would suggest to include a suitable paragraph into the man-pages and other end-user targeted documentation on gnupg.org. While a end-user cannot be expected to read an RFC, the man-page is surely not beyond his/her reach. cu, Sven From shavital at mac.com Wed Apr 4 13:02:17 2007 From: shavital at mac.com (Charly Avital) Date: Wed, 04 Apr 2007 14:02:17 +0300 Subject: In-Reply-To: References: Message-ID: <461385B9.4070302@mac.com> Mark Dymek wrote the following on 3/27/07 6:02 PM: > when i install gnupg 1.4.7 on a mac os x systerm where does the > executable file get installed? in other words where does gnupg live on > my system. On MacOS X, GnuPG's executable path is /Users/[short-name]/.gnupg. You can also ask at the macgpg-users list: Charly From dshaw at jabberwocky.com Wed Apr 4 13:42:56 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Wed, 4 Apr 2007 07:42:56 -0400 Subject: your mail In-Reply-To: References: Message-ID: <20070404114256.GF1606@jabberwocky.com> On Tue, Mar 27, 2007 at 12:02:51PM -0400, Mark Dymek wrote: > when i install gnupg 1.4.7 on a mac os x systerm where does the > executable file get installed? in other words where does gnupg live > on my system. I can't speak for the binary releases from macgpg.sourceforge.net, but if you are building from the regular source code release, gpg ends up in /usr/local/bin, and the keyserver helpers end up in /usr/local/libexec/gnupg. David From dshaw at jabberwocky.com Wed Apr 4 13:43:37 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Wed, 4 Apr 2007 07:43:37 -0400 Subject: In-Reply-To: <461385B9.4070302@mac.com> References: <461385B9.4070302@mac.com> Message-ID: <20070404114337.GG1606@jabberwocky.com> On Wed, Apr 04, 2007 at 02:02:17PM +0300, Charly Avital wrote: > Mark Dymek wrote the following on 3/27/07 6:02 PM: > > when i install gnupg 1.4.7 on a mac os x systerm where does the > > executable file get installed? in other words where does gnupg live on > > my system. > > On MacOS X, GnuPG's executable path is /Users/[short-name]/.gnupg. No, that's where it stores keyrings. The executable is the 'gpg' program itself. David From benjamin at py-soft.co.uk Wed Apr 4 13:45:41 2007 From: benjamin at py-soft.co.uk (Benjamin Donnachie) Date: Wed, 04 Apr 2007 12:45:41 +0100 Subject: In-Reply-To: <461385B9.4070302@mac.com> References: <461385B9.4070302@mac.com> Message-ID: <46138FE5.7020903@py-soft.co.uk> Charly Avital wrote: > On MacOS X, GnuPG's executable path is /Users/[short-name]/.gnupg. That's where gnupg stores its config files. The executables normally live in /usr/local/bin Ben From shavital at mac.com Wed Apr 4 14:15:53 2007 From: shavital at mac.com (Charly Avital) Date: Wed, 04 Apr 2007 15:15:53 +0300 Subject: gpg executable path In-Reply-To: <20070404114337.GG1606@jabberwocky.com> References: <461385B9.4070302@mac.com> <20070404114337.GG1606@jabberwocky.com> Message-ID: <461396F9.4000409@mac.com> David Shaw wrote the following on 4/4/07 2:43 PM: > On Wed, Apr 04, 2007 at 02:02:17PM +0300, Charly Avital wrote: >> Mark Dymek wrote the following on 3/27/07 6:02 PM: >>> when i install gnupg 1.4.7 on a mac os x systerm where does the >>> executable file get installed? in other words where does gnupg live on >>> my system. >> On MacOS X, GnuPG's executable path is /Users/[short-name]/.gnupg. > > No, that's where it stores keyrings. The executable is the 'gpg' > program itself. > > David David, I wouldn't dream of arguing with you, and I have no doubt that you are right. All I know, empirically, is that: - /.gnupg is where gpg stores not only keyrings, but also gpg.conf, trustdb.gpg and random_seed. - that is the path I insert in TB+Enigmail's OpenPGP Preferences/Basic/Basic Settings field 'GnuPG executable path', to make TB inter-operate with GnuPG. Charly From shavital at mac.com Wed Apr 4 14:25:20 2007 From: shavital at mac.com (Charly Avital) Date: Wed, 04 Apr 2007 15:25:20 +0300 Subject: GnuPG executable path - Correction/apologiy In-Reply-To: <20070404114337.GG1606@jabberwocky.com> References: <461385B9.4070302@mac.com> <20070404114337.GG1606@jabberwocky.com> Message-ID: <46139930.70207@mac.com> David Shaw wrote the following on 4/4/07 2:43 PM: > On Wed, Apr 04, 2007 at 02:02:17PM +0300, Charly Avital wrote: >> Mark Dymek wrote the following on 3/27/07 6:02 PM: >>> when i install gnupg 1.4.7 on a mac os x systerm where does the >>> executable file get installed? in other words where does gnupg live on >>> my system. >> On MacOS X, GnuPG's executable path is /Users/[short-name]/.gnupg. > > No, that's where it stores keyrings. The executable is the 'gpg' > program itself. > > David Correction! Sorry, *my mistake*. What I insert in TB+Enigmail is, truly '/usr/local/bin/gpg' To be more precise, I am using now /usr/local/bin/gpg2, because I am running gpg2 (side by side with /usr/local/bin/gpg). From dshaw at jabberwocky.com Wed Apr 4 14:38:38 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Wed, 4 Apr 2007 08:38:38 -0400 Subject: no, it's not an email client problem, ... In-Reply-To: <46134950.7060601@radde.name> References: <4612D5A3.5020106@sixdemonbag.org> <46134950.7060601@radde.name> Message-ID: <20070404123838.GH1606@jabberwocky.com> On Wed, Apr 04, 2007 at 08:44:32AM +0200, Sven Radde wrote: > Hi! > > Robert J. Hansen schrieb: > > It is not feasible to undetectably remove, add, or modify text in a > > clearsigned message. > > > > Your example adds, modifies, etc., text in the _signature_. > > > > The _message_ remains protected. > It should have become clear by the course of the discussion that not > everybody is aware of this (arguably) subtle distinction. > I assume that it would even less the case for GnuPG users that do not > follow this list (i.e. non-geeks, a.k.a. end-users, no offense intended :-). > I thought myself to be quite an adept user of GnuPG but did not realize > that Comment lines could be freely altered. Congrats to everyone who was > actively aware of the fact before this discussion was brought up here, > but, IMHO, said group would have been limited to the developers or other > deeply involved people. > > On the other hand, the implications of this are not so serious as to > make a huge fuss about it. > I would suggest to include a suitable paragraph into the man-pages and > other end-user targeted documentation on gnupg.org. While a end-user > cannot be expected to read an RFC, the man-page is surely not beyond > his/her reach. I almost hate to drag reality into this discussion, but the man page does say exactly that: --comment string --no-comments Use string as a comment string in clear text signatures and ASCII armored messages or keys (see --armor). The default behavior is not to use a comment string. --comment may be repeated multiple times to get multiple comment strings. --no-comments removes all comments. It is a good idea to keep the length of a single comment below 60 characters to avoid problems with mail programs wrapping such lines. Note that comment lines, like all other header lines, are not protected by the signature. And while we're at it, the RFC says it too: The Armor Headers are pairs of strings that can give the user or the receiving OpenPGP implementation some information about how to decode or use the message. The Armor Headers are a part of the armor, not a part of the message, and hence are not protected by any signatures applied to the message. David From dshaw at jabberwocky.com Wed Apr 4 14:40:24 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Wed, 4 Apr 2007 08:40:24 -0400 Subject: gpg executable path In-Reply-To: <461396F9.4000409@mac.com> References: <461385B9.4070302@mac.com> <20070404114337.GG1606@jabberwocky.com> <461396F9.4000409@mac.com> Message-ID: <20070404124024.GI1606@jabberwocky.com> On Wed, Apr 04, 2007 at 03:15:53PM +0300, Charly Avital wrote: > David Shaw wrote the following on 4/4/07 2:43 PM: > > On Wed, Apr 04, 2007 at 02:02:17PM +0300, Charly Avital wrote: > >> Mark Dymek wrote the following on 3/27/07 6:02 PM: > >>> when i install gnupg 1.4.7 on a mac os x systerm where does the > >>> executable file get installed? in other words where does gnupg live on > >>> my system. > >> On MacOS X, GnuPG's executable path is /Users/[short-name]/.gnupg. > > > > No, that's where it stores keyrings. The executable is the 'gpg' > > program itself. > > > > David > > David, > > I wouldn't dream of arguing with you, and I have no doubt that you are > right. > > All I know, empirically, is that: > - /.gnupg is where gpg stores not only keyrings, but also gpg.conf, > trustdb.gpg and random_seed. Right. Those aren't executables. An executable is the file that you, well, execute: the 'gpg' binary itself. Each user gets their own personal .gnupg directory, but (generally speaking) all users share a single 'gpg' binary. David From d.tischler at gmx.net Wed Apr 4 16:06:37 2007 From: d.tischler at gmx.net (Sebastian Schreiner) Date: Wed, 04 Apr 2007 16:06:37 +0200 Subject: signature digest conflict in message Message-ID: <4613B0ED.80804@gmx.net> Hello, unfortunately I have problems verifying some signed Mails using GPG for Windows and Enigmail with Thunderbird. The problem only affects the "Reverify Your Email Address"-mails from the PGP Global Directory. The error message reads: C:\\Programme\\GNU\\GnuPG\\gpg.exe --charset utf8 --status-fd 1 --batch --no-tty --status-fd 2 --verify gpg: Signature made 03/30/07 11:33:09 using RSA key ID CA57AD7C gpg: WARNING: signature digest conflict in message gpg: Can't check signature: general error Can somebody help me on this. I didn't manage to find a solution on the web. Thanks, Dominik. -- PGP: 0x9BE1FDBA : CD6D 383B BE31 29BF 221D F78D 76AC 3F2A 9BE1 FDBA From wk at gnupg.org Wed Apr 4 17:44:39 2007 From: wk at gnupg.org (Werner Koch) Date: Wed, 04 Apr 2007 17:44:39 +0200 Subject: signature digest conflict in message In-Reply-To: <4613B0ED.80804@gmx.net> (Sebastian Schreiner's message of "Wed\, 04 Apr 2007 16\:06\:37 +0200") References: <4613B0ED.80804@gmx.net> Message-ID: <87fy7gywig.fsf@wheatstone.g10code.de> On Wed, 4 Apr 2007 16:06, d.tischler at gmx.net said: > unfortunately I have problems verifying some signed Mails using GPG for > Windows and Enigmail with Thunderbird. The problem only affects the > "Reverify Your Email Address"-mails from the PGP Global Directory. The Such a case has been reported rcently and it turned out that PGP creates invalid OpenPGP messages. Due to some stronger checks we employ now gpg reveals this problem. --allow-multiple-messages should do as a workaround. Not tested, though. Shalom-Salam, Werner From dshaw at jabberwocky.com Wed Apr 4 18:51:48 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Wed, 4 Apr 2007 12:51:48 -0400 Subject: signature digest conflict in message In-Reply-To: <4613B0ED.80804@gmx.net> References: <4613B0ED.80804@gmx.net> Message-ID: <20070404165148.GA7761@jabberwocky.com> On Wed, Apr 04, 2007 at 04:06:37PM +0200, Sebastian Schreiner wrote: > Hello, > unfortunately I have problems verifying some signed Mails using GPG for > Windows and Enigmail with Thunderbird. The problem only affects the > "Reverify Your Email Address"-mails from the PGP Global Directory. The > error message reads: > > C:\\Programme\\GNU\\GnuPG\\gpg.exe --charset utf8 --status-fd 1 --batch > --no-tty --status-fd 2 --verify > gpg: Signature made 03/30/07 11:33:09 using RSA key ID CA57AD7C > gpg: WARNING: signature digest conflict in message > gpg: Can't check signature: general error > > > Can somebody help me on this. I didn't manage to find a solution on the web. This is a known bug with the PGP Global Directory. Essentially, it sends out PGP/MIME messages that say "Here comes some data that I signed with SHA-1", and then says "And here's the signature using SHA-256". SHA-1 != SHA-256, so it doesn't work. I reported the bug a while back. Presumably it'll be fixed at some point. David From d.tischler at gmx.net Wed Apr 4 18:15:10 2007 From: d.tischler at gmx.net (Sebastian Schreiner) Date: Wed, 04 Apr 2007 18:15:10 +0200 Subject: still: signature digest conflict in message In-Reply-To: <87fy7gywig.fsf@wheatstone.g10code.de> References: <4613B0ED.80804@gmx.net> <87fy7gywig.fsf@wheatstone.g10code.de> Message-ID: <4613CF0E.6010109@gmx.net> Unfortunately it does not help (Thank you however Werner). I inserted the option in "additional options for GnuPG in the Enigmail GUI. The command line now reads: gpg.exe --charset utf8 --allow-multiple-messages --batch --no-tty --status-fd 2 --verify Still there is the same message: gpg: Signature made 03/30/07 18:25:23 using RSA key ID CA57AD7C gpg: WARNING: signature digest conflict in message gpg: Can't check signature: general error I'd be glad to get a hint... Dominik Werner Koch schrieb: > On Wed, 4 Apr 2007 16:06, d.tischler at gmx.net said: > >> unfortunately I have problems verifying some signed Mails using GPG for >> Windows and Enigmail with Thunderbird. The problem only affects the >> "Reverify Your Email Address"-mails from the PGP Global Directory. The > > Such a case has been reported rcently and it turned out that PGP creates > invalid OpenPGP messages. Due to some stronger checks we employ now gpg > reveals this problem. > > --allow-multiple-messages > > should do as a workaround. Not tested, though. > > > Shalom-Salam, > > Werner > > -- PGP: 0x9BE1FDBA : CD6D 383B BE31 29BF 221D F78D 76AC 3F2A 9BE1 FDBA From ublument at Bear.com Wed Apr 4 19:34:21 2007 From: ublument at Bear.com (Blumenthal, Uri) Date: Wed, 4 Apr 2007 13:34:21 -0400 Subject: still: signature digest conflict in message References: <4613B0ED.80804@gmx.net> <87fy7gywig.fsf@wheatstone.g10code.de> <4613CF0E.6010109@gmx.net> Message-ID: I confirm. On a different problem caused by the same PGP :-). Even with --allow-multiple-messages, cleartext-signed PGP/MIME messages produced by PGP Universal server still are not verifiable. Thank you! -- Regards, Uri Blumenthal *********************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. *********************************************************************** From jharris at widomaker.com Fri Apr 6 00:01:42 2007 From: jharris at widomaker.com (Jason Harris) Date: Thu, 5 Apr 2007 18:01:42 -0400 Subject: new (2007-04-01) keyanalyze results (+sigcheck) Message-ID: <20070405220142.GA1651@wilma.widomaker.com> New keyanalyze results are available at: http://keyserver.kjsl.com/~jharris/ka/2007-04-01/ Signatures are now being checked using keyanalyze+sigcheck: http://dtype.org/~aaronl/ Earlier reports are also available, for comparison: http://keyserver.kjsl.com/~jharris/ka/ Even earlier monthly reports are at: http://dtype.org/keyanalyze/ SHA-1 hashes and sizes for all the "permanent" files: 0bc2904f1f73185cd87886b7dd6e5c4d1d3daf78 14673996 preprocess.keys 77b3a2b92712270af911bf79b002f5f912d4a6b6 8550477 othersets.txt 33c4117bf95630032dcd4267117e9769bde5f26c 3513424 msd-sorted.txt 616ac10c985055264085ad236b1974b7cfb372cb 2278 keyring_stats a17ab023cbafce762d6a89c1b145648512cdd9a7 1382861 msd-sorted.txt.bz2 048c8c87770c7cf35dfe4e3e8f34df4ce3724843 26 other.txt af5fd8d5f1cf4973d21637436bd5fcd6fe289107 1856679 othersets.txt.bz2 91e61f7c87402b32a3426ab4a7ecc643c44572e7 5975647 preprocess.keys.bz2 1077fc5a66d1bf7505197b7aa6020f89f60d82fa 14895 status.txt ad99b4bfaf4fc2ec70a7538d5ebe838bed9db194 194539 top1000table.html 37d2f984866ae37937a377fab07646ac6af9504d 29679 top1000table.html.gz 0591cb468b3c1311a76be940e853773aacb3d377 9800 top50table.html 40a774d1848adec9c6cf3b204b1ea8182fd2a1b2 2529 D3/D39DA0E3 -- Jason Harris | NIC: JH329, PGP: This _is_ PGP-signed, isn't it? jharris at widomaker.com _|_ web: http://keyserver.kjsl.com/~jharris/ Got photons? (TM), (C) 2004 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 313 bytes Desc: not available Url : /pipermail/attachments/20070405/91c04cfe/attachment.pgp From moses.mason at gmail.com Fri Apr 6 02:48:13 2007 From: moses.mason at gmail.com (Moses) Date: Fri, 6 Apr 2007 08:48:13 +0800 Subject: How to sign mail and news under Windows system by using GnuPG? Message-ID: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> Hi list, Could anybody tell me how to sign a email under Windows by using GnuPG? I've done some google, but could not find any Windows mail client support GnuPG. Furthermore, I also want use GnuPG in Outlook Express to sign mails and news, could anyone tell me how to do it? Any suggestions is appreciated. Regards, M. From rjh at sixdemonbag.org Fri Apr 6 04:29:38 2007 From: rjh at sixdemonbag.org (Robert J. Hansen) Date: Thu, 5 Apr 2007 21:29:38 -0500 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> Message-ID: <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Could anybody tell me how to sign a email under Windows by using > GnuPG? I've done some google, but could not find any Windows mail Typically, this is done with the assistance of an email plugin. Probably the most popular Windows email client that has GnuPG support is Thunderbird (http://www.mozilla.com) with the Enigmail plug-in (http://enigmail.mozdev.org). I've used this combination for years with great success. The Enigmail mailing list is also a very newbie-friendly place. There are lots of people there who will be able to help you in getting Enigmail set up and configured appropriately. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) iQEcBAEBCAAGBQJGFbCSAAoJELcA9IL+r4EJgwcH/3M2S2p8WIH4FjdOyXEsgj2p kuJnn6kbRnCgWalPI4HYFPTLZEhedJPd9BTBOCRExJ5tuw39R10KNMvyLx+ist2r T8ZIMtYjXLeclyZbIrLxYdsMEv1xmfMrZCZSy0362e8Cd8foKSJ6uZ+U0vjoijwy Qe/HUMDO3RcVXK8JDmMm7QImN2re1XsNQImj6DsaPkuUTAZtLwudyVxkagT9EhBR geVFRUpR+/MUyo1g+Bal0IPmX5kMSt2CsjzZVyB7C4H4UKFO3UB1KrQXM3zmpf04 Q38lSL0FCp3oh/tLgHZAde2CS6TnHLQIyabMxTCrqLBKLpBET7yfVCntcZCyoSA= =moOv -----END PGP SIGNATURE----- From bob at rsmits.ca Fri Apr 6 03:28:29 2007 From: bob at rsmits.ca (Robert Smits) Date: Thu, 5 Apr 2007 18:28:29 -0700 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> Message-ID: <200704051828.29860.bob@rsmits.ca> On Thursday 05 April 2007 17:48, Moses wrote: > Hi list, > > Could anybody tell me how to sign a email under Windows by using > GnuPG? I've done some google, but could not find any Windows mail > client support GnuPG. Furthermore, I also want use GnuPG in Outlook > Express to sign mails and news, could anyone tell me how to do it? When I google "gnupg Windows client" I find the following programs in Windows that are supported: Enigmail Is a plug-in for Mozilla's mailer. EudoraGPG Is a plugin for the proprietary Eudora MUA. Gpg4win Gpg4win is an installer package for Windows with computer programs and handbooks for email and file encryption. GPGee GPGee (GNU Privacy Guard Explorer Extension) is a shell extension that adds Windows explorer right-click menu support for GnuPGIs a MS-Windows program to integrate GnuPG into the Desktop. GPGOE Is a plugin for the proprietary Outlook Express MUA. GPGol A plug-in for Microsoft Outlook 2003. GPGrelay Is a Windows program which can be used to use GnuPG with all MUAs. Pocket GnuPG Pocket GnuPG is the PocketConsole port of GnuPG. Scribe Scribe is a small and fast email client that lets you send, receive and manage email without fuss. Scribe comes with a plugin that calls GnuPG. Sylpheed-Claws Is a very nice GTK+ based MUA with full support for GnuPG. The Windows version is part of Gpg4win . wija wija is a free and cross-platform Jabber/XMPP client written in Java, with built-in GnuPG key rings management GUI. Its extended protocols allow users to encrypt chat and multi-user chat as well as encrypting/signing messages and signing presence of the user. It is multilingual and runs on GNU/Linux, Mac OS X and Windows. Possibly one of these can work for you. bob at rsmits.ca "I'm not one of those who think Bill Gates is the devil. I simply suspect that if Microsoft ever met up with the devil, it wouldn't need an interpreter." -InfoWorld Editor Nicholas Petreley From jmoore3rd at bellsouth.net Fri Apr 6 05:13:52 2007 From: jmoore3rd at bellsouth.net (John W. Moore III) Date: Thu, 05 Apr 2007 23:13:52 -0400 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> Message-ID: <4615BAF0.4010402@bellsouth.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Robert J. Hansen wrote: >> Could anybody tell me how to sign a email under Windows by using >> GnuPG? I've done some google, but could not find any Windows mail > > Typically, this is done with the assistance of an email plugin. > Probably the most popular Windows email client that has GnuPG support > is Thunderbird (http://www.mozilla.com) with the Enigmail plug-in > (http://enigmail.mozdev.org). I've used this combination for years > with great success. > > The Enigmail mailing list is also a very newbie-friendly place. > There are lots of people there who will be able to help you in > getting Enigmail set up and configured appropriately. While I heartily endorse Robert's suggestion; You specifically requested Help with Outlook Express/Outlook. For this application I suggest that You install either GPGshell or WinPT. Both will give You a Frontend (GUI) for using GnuPG within any Compose Screen displayed on your PC. I am a Fan of GPGshell which can easily be found with a Google Search. I simply cannot recall the Link off the top of My head. Both applications will provide You with Key Management & Edit functions in addition to the ability to Sign, Encrypt & Encrypt/Sign. With GPGshell the only real 'Secret' is that routine Signing is accomplished by using the 'Clearsign' option from the Rt. Click context menu. You haven't asked, Yet, but I am anticipating that your next Question will be regarding a gpg.conf File. Never hesitate to ask for assistance. The only 'Stupid' Question is the one not asked. I am also going to send You an 'Invite' to the PGP-Basics Group where many Answers & Advice are available 24/7/365. JOHN ;) Timestamp: Thursday 05 Apr 2007, 23:13 --400 (Eastern Daylight Time) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8-svn4471: (MingW32) Comment: Public Key at: http://tinyurl.com/8cpho Comment: Gossamer Spider Web of Trust: http://www.gswot.org Comment: My Homepage: http://tinyurl.com/yzhbhx iQEcBAEBCgAGBQJGFbrrAAoJEBCGy9eAtCsPqVwH/0H6ycQ/TrBHglP1s3iuEahp qzL1P8Uv2rdpjKr0amJspb9TDg0cHlP5Y53ukomFNvKf3lnSsInclhvk9IH5VbtN ETdT46IVtPvTB2DEpNSmfFrvvhQB24SjYkfptyti/qBIuNXoXkLlEX8JvbepY9HG /kYJfw4UtnAII8mLwSxIGouR3vlYX05pny6hdmqgMuKtVXztQONxrhafjpcOnwru EjVR8+60x13uOup7wy9Uk/206i26jObyrWKcMawJepDX84exYM5X3L+sKbVRNnhU GdNmA2X9LaFWO9mF7ytKY/K/f11rturFfNoa/bu0PKDX8QFRaphaDxa70rIlbUQ= =Myx6 -----END PGP SIGNATURE----- From moses.mason at gmail.com Fri Apr 6 07:38:36 2007 From: moses.mason at gmail.com (Moses) Date: Fri, 6 Apr 2007 13:38:36 +0800 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <4615BAF0.4010402@bellsouth.net> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> <4615BAF0.4010402@bellsouth.net> Message-ID: <87bcf3800704052238i48c9469esade17a949a44cfa2@mail.gmail.com> On 4/6/07, John W. Moore III wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > Robert J. Hansen wrote: > >> Could anybody tell me how to sign a email under Windows by using > >> GnuPG? I've done some google, but could not find any Windows mail > > > > Typically, this is done with the assistance of an email plugin. > > Probably the most popular Windows email client that has GnuPG support > > is Thunderbird (http://www.mozilla.com) with the Enigmail plug-in > > (http://enigmail.mozdev.org). I've used this combination for years > > with great success. > > > > The Enigmail mailing list is also a very newbie-friendly place. > > There are lots of people there who will be able to help you in > > getting Enigmail set up and configured appropriately. > > While I heartily endorse Robert's suggestion; You specifically requested > Help with Outlook Express/Outlook. For this application I suggest that > You install either GPGshell or WinPT. Both will give You a Frontend > (GUI) for using GnuPG within any Compose Screen displayed on your PC. > > I am a Fan of GPGshell which can easily be found with a Google Search. > I simply cannot recall the Link off the top of My head. Both > applications will provide You with Key Management & Edit functions in > addition to the ability to Sign, Encrypt & Encrypt/Sign. With GPGshell > the only real 'Secret' is that routine Signing is accomplished by using > the 'Clearsign' option from the Rt. Click context menu. > Thank you. I'm using GPGshell now :) A newbie question: how to better use GPGshell in OE? Because I found it's a little hard for me to understand how to sign/encrypt a mail after I composed it. The way I do right now is, "save as" the mail first, go to the windows explorer to sign/encrypt the mail, drag the result .gpg/.asc file back to the OE and send it. So..is there any GPG plug-in for OE exists can do all these jobs along..without switch between OE and other applications? Thanks a lot. Regards, M. From sunblaster5 at gmail.com Fri Apr 6 06:19:33 2007 From: sunblaster5 at gmail.com (Rocko) Date: Thu, 05 Apr 2007 21:19:33 -0700 Subject: GPG gives wierd data when trying to decrypt Message-ID: <1175833174.14173.5.camel@localhost> When i try to decrypt a file the letters in the terminal window get crazy. its like they become encrypted, or maybe the terminal is displaying the encrypted file in the window, i really don't know. all i know is i can't decrypt any files that i've encrpyted. using gpg --decrypt filename on Unbuntu Dapper From JPClizbe at tx.rr.com Fri Apr 6 09:10:01 2007 From: JPClizbe at tx.rr.com (John Clizbe) Date: Fri, 06 Apr 2007 02:10:01 -0500 Subject: GPG gives wierd data when trying to decrypt In-Reply-To: <1175833174.14173.5.camel@localhost> References: <1175833174.14173.5.camel@localhost> Message-ID: <4615F249.8040002@tx.rr.com> Rocko wrote: > When i try to decrypt a file the letters in the terminal window get > crazy. > its like they become encrypted, or maybe the terminal is displaying the > encrypted file in the window, i really don't know. > all i know is i can't decrypt any files that i've encrpyted. > > using gpg --decrypt filename > on Unbuntu Dapper Yep, that is GnuPG's normal behavior with --decrypt - writing its output to stdout, your terminal window. From the man page: -d, --decrypt [file] Decrypt file (or stdin if no file is specified) and write it to stdout (or the file specified with --output). If the decrypted file is signed, the signature is also verified. This command differs from the default operation, as it never writes to the filename which is included in the file and it rejects files which don't begin with an encrypted message. If specifying --decrypt, you should also specify either '--output ' or redirect output, eg. gpg --decrypt encrypted-file > output-file. Specifying only the encrypted filename to gpg should be all you need to do. Without any commands, gpg will perform a reasonable action depending on the type of file it is given as input (an encrypted message is decrypted, a signature is verified, etc...). It should write the decrypted file to the filename stored in the encrypted file. -- John P. Clizbe Inet: John (a) Mozilla-Enigmail.org You can't spell fiasco without SCO. PGP/GPG KeyID: 0x608D2A10/0x18BB373A "what's the key to success?" / "two words: good decisions." "what's the key to good decisions?" / "one word: experience." "how do i get experience?" / "two words: bad decisions." "Just how do the residents of Haiku, Hawai'i hold conversations?" -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 663 bytes Desc: OpenPGP digital signature Url : /pipermail/attachments/20070406/533547e6/attachment-0001.pgp From JPClizbe at tx.rr.com Fri Apr 6 09:17:01 2007 From: JPClizbe at tx.rr.com (John Clizbe) Date: Fri, 06 Apr 2007 02:17:01 -0500 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <87bcf3800704052238i48c9469esade17a949a44cfa2@mail.gmail.com> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> <4615BAF0.4010402@bellsouth.net> <87bcf3800704052238i48c9469esade17a949a44cfa2@mail.gmail.com> Message-ID: <4615F3ED.4060207@tx.rr.com> Moses wrote: > > Thank you. I'm using GPGshell now :) > > A newbie question: how to better use GPGshell in OE? Because I found > it's a little hard for me to understand how to sign/encrypt a mail > after I composed it. > > The way I do right now is, "save as" the mail first, go to the windows > explorer to sign/encrypt the mail, drag the result .gpg/.asc file back > to the OE and send it. > > So..is there any GPG plug-in for OE exists can do all these jobs > along..without switch between OE and other applications? Check out the GPGoe plugin: http://wald.intevation.org/projects/gpgoe -- John P. Clizbe Inet: John (a) Mozilla-Enigmail.org You can't spell fiasco without SCO. PGP/GPG KeyID: 0x608D2A10/0x18BB373A "what's the key to success?" / "two words: good decisions." "what's the key to good decisions?" / "one word: experience." "how do i get experience?" / "two words: bad decisions." "Just how do the residents of Haiku, Hawai'i hold conversations?" -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 663 bytes Desc: OpenPGP digital signature Url : /pipermail/attachments/20070406/ba006cab/attachment.pgp From moses.mason at gmail.com Fri Apr 6 09:55:03 2007 From: moses.mason at gmail.com (Moses) Date: Fri, 6 Apr 2007 15:55:03 +0800 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <4615F3ED.4060207@tx.rr.com> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> <4615BAF0.4010402@bellsouth.net> <87bcf3800704052238i48c9469esade17a949a44cfa2@mail.gmail.com> <4615F3ED.4060207@tx.rr.com> Message-ID: <87bcf3800704060055g155eeae2q9031eb3350541a81@mail.gmail.com> I got it: right click on the GPGShell's icontray and choose "Window". Thanks Laurent, John and thank you all! On 4/6/07, John Clizbe wrote: > Moses wrote: > > > > Thank you. I'm using GPGshell now :) > > > > A newbie question: how to better use GPGshell in OE? Because I found > > it's a little hard for me to understand how to sign/encrypt a mail > > after I composed it. > > > > The way I do right now is, "save as" the mail first, go to the windows > > explorer to sign/encrypt the mail, drag the result .gpg/.asc file back > > to the OE and send it. From yochanon at localnet.com Fri Apr 6 08:29:38 2007 From: yochanon at localnet.com (John B) Date: Fri, 6 Apr 2007 01:29:38 -0500 Subject: Second problem...gpg or kgpg? Message-ID: <200704060129.38524.yochanon@localnet.com> Hi again, Out of the blue, it seems kgpg doesn't see my .gnupg directory. I opened it up the other day just to check something, and it showed no keys at all. I went into the settings and all it allows is to see my /home/me directory which has a couple of .asc keys(?) in it but had no gpg.conf file until I imported the .asc keys. Is there a way to fix what's going on? Has this happened to anyone else? I did absolutely nothing with gpg or kgpg...no updates (other than the SuSE security update 2 or 3 months ago IIRR) to either of them. Still with 1.4.1 I think it is and was working fine until I happened to see it the other day. Sorry I'm not too good at explaining myself, but if there's any more info needed, it's easier if someone asks me and then I'll know better what needs to be said about my problem. From lists_de at zemisch.de Fri Apr 6 10:10:03 2007 From: lists_de at zemisch.de (Dirk Zemisch) Date: Fri, 6 Apr 2007 15:10:03 +0700 Subject: How to sign mail and news under Windows system by using GnuPG? In-Reply-To: <87bcf3800704052238i48c9469esade17a949a44cfa2@mail.gmail.com> References: <87bcf3800704051748u12b2bc7aw487fba119b10fb3c@mail.gmail.com> <04A951FA-B5ED-4146-AD66-D7CE38A11FE1@sixdemonbag.org> <4615BAF0.4010402@bellsouth.net> <87bcf3800704052238i48c9469esade17a949a44cfa2@mail.gmail.com> Message-ID: <6310151422.20070406151003@zemisch.de> Hello GnuPG Users, On Friday, April 6, 2007, at 13:38 GMT +08 (12:38, the same day my local time), moses.mason at gmail.com wrote: > The way I do right now is, "save as" the mail first, go to the windows > explorer to sign/encrypt the mail, drag the result .gpg/.asc file back > to the OE and send it. You can also give a try to GPGRelay [1], a small relaying server, doing all the work automatically on all outgoing and incoming mail. Works great here. And it is compatible to almost all mail clients (I don't know any it isn't). Another not mentioned so far WIN mail client which works great with GPG is TheBat! [2] No plugin needed and it also works with S/MIME if needed. [1] http://sites.inka.de/tesla/gpgrelay.html [2] http://www.ritlabs.com/en/products/thebat/ -- Adios, Dirk An excerpt from William Feather: "The wisdom of the wise and the experience of the ages is preserved into perpetuity by a nation's proverbs, fables, folk sayings and quotations." From laurent.jumet at skynet.be Fri Apr 6 10:21:44 2007 From: laurent.jumet at skynet.be (Laurent Jumet) Date: Fri, 06 Apr 2007 10:21:44 +0200 Subject: Secret key... Message-ID: Hello ! My bank sent me a new card with a processor on it (SmartCard ?), in replacement of previous one, which was the same. The bank told me that the passphrase did not change. This implyes that the passphrase is not stored in the secret key on the card? -- Laurent Jumet KeyID: 0xCFAF704C From yochanon at localnet.com Fri Apr 6 08:22:52 2007 From: yochanon at localnet.com (John B) Date: Fri, 6 Apr 2007 01:22:52 -0500 Subject: Un-revoking a key pair Message-ID: <200704060122.52280.yochanon@localnet.com> Hi gang, Somehow the other night I accidently imported a revoking thing for my main secret and public key pair when I was using kgpg. Kgpg tells me I need to un-revoke it in the manual editor, so, could someone tell me a quick and easy way to do so, please? Is it possible to un-revoke? From mfuhr at fuhr.org Fri Apr 6 11:34:44 2007 From: mfuhr at fuhr.org (Michael Fuhr) Date: Fri, 6 Apr 2007 03:34:44 -0600 Subject: GPG gives wierd data when trying to decrypt In-Reply-To: <1175833174.14173.5.camel@localhost> References: <1175833174.14173.5.camel@localhost> Message-ID: <20070406093443.GA21586@winnie.fuhr.org> On Thu, Apr 05, 2007 at 09:19:33PM -0700, Rocko wrote: > When i try to decrypt a file the letters in the terminal window get > crazy. > its like they become encrypted, or maybe the terminal is displaying the > encrypted file in the window, i really don't know. > all i know is i can't decrypt any files that i've encrpyted. > > using gpg --decrypt filename > on Unbuntu Dapper Does the original file contain binary data? Are you using symmetric or public-key encryption? Could you show the encryption command? If you redirect standard output, do you get any errors? gpg -d filename > filename.decrypted What do you get for the following? echo test | gpg -c | gpg -d You should be prompted twice for the encryption passphrase, then prompted for the decryption passphrase. The final output should look like this: gpg: CAST5 encrypted data gpg: encrypted with 1 passphrase test gpg: WARNING: message was not integrity protected -- Michael Fuhr From sadam at clemson.edu Fri Apr 6 14:59:21 2007 From: sadam at clemson.edu (Adam Schreiber) Date: Fri, 6 Apr 2007 08:59:21 -0400 Subject: Un-revoking a key pair In-Reply-To: <200704060122.52280.yochanon@localnet.com> References: <200704060122.52280.yochanon@localnet.com> Message-ID: <8298be230704060559p3a73bf11p31d77f1f77c60633@mail.gmail.com> On 4/6/07, John B wrote: > Somehow the other night I accidently imported a revoking thing for my main > secret and public key pair when I was using kgpg. Kgpg tells me I need to > un-revoke it in the manual editor, so, could someone tell me a quick and easy > way to do so, please? Is it possible to un-revoke? I believe you simply need to sign the keys again. When you create them, a self signature is added. When you revoke them, a revoking signature is added. Thus to unrevoke them an additional signature is needed. Cheers, Adam From dshaw at jabberwocky.com Fri Apr 6 16:48:17 2007 From: dshaw at jabberwocky.com (David Shaw) Date: Fri, 6 Apr 2007 10:48:17 -0400 Subject: Un-revoking a key pair In-Reply-To: <200704060122.52280.yochanon@localnet.com> References: <200704060122.52280.yochanon@localnet.com> Message-ID: <20070406144817.GA10529@jabberwocky.com> On Fri, Apr 06, 2007 at 01:22:52AM -0500, John B wrote: > > Hi gang, > > Somehow the other night I accidently imported a revoking thing for > my main secret and public key pair when I was using kgpg. Kgpg tells > me I need to un-revoke it in the manual editor, so, could someone > tell me a quick and easy way to do so, please? Is it possible to > un-revoke? Yes it is possible. The first thing is that you must not distribute the keys while they are in this revoked state: do not send them to anyone, and absolutely do not send them to a keyserver. Here's how to unrevoke. It's a very manual process. Be safe: make a backup before you do stuff like this. 1) Export the public key into a file. gpg --export (thekey) > mykey.gpg 2) Split it into parts: gpgsplit mykey.gpg This breaks the key into multiple files with names like "000001-006.public_key". 3) Figure out which packet is the revocation. It's likely to be "000002-002.sig", but make sure with: gpg --list-packets 000002-002.sig That will show information about the packet. If the sigclass is set to 0x20, that's the revocation. Delete that file. 4) Put the key back together again: cat 0000* > myfixedkey.gpg 5) Remove the old key: gpg --expert --delete-key (thekey) You need --expert here so GPG will let you delete the public key when a private key is still around. 6) Import the new key: gpg --import myfixedkey.gpg David From me at psmay.com Fri Apr 6 17:09:27 2007 From: me at psmay.com (Peter S. May) Date: Fri, 06 Apr 2007 11:09:27 -0400 Subject: Un-revoking a key pair In-Reply-To: <200704060122.52280.yochanon@localnet.com> References: <200704060122.52280.yochanon@localnet.com> Message-ID: <461662A7.3040907@psmay.com> John B wrote: > Somehow the other night I accidently imported a revoking thing for my main > secret and public key pair when I was using kgpg. Kgpg tells me I need to > un-revoke it in the manual editor, so, could someone tell me a quick and easy > way to do so, please? Is it possible to un-revoke? Actually, you're technically not supposed to be able to un-revoke a key, but as long as the revocation certificate generated hasn't been made public (sent to other people, uploaded to a keyserver, or otherwise posted) it should be possible to make a copy of the key, remove the revocation information from that copy, then remove all knowledge of the key from your keychain and import the non-revoked version back in. What you'd be doing isn't really un-revoking the key--you're just convincing gpg that it was never revoked in the first place. If gpg doesn't know it was revoked, and none of the public keyservers know it was revoked, and nobody else in the world knows it was revoked, then it was effectively never revoked. Nice, eh? Incidentally, if your revocation certificate was made public in any way, you'll have to generate and use a new key. Sorry--these are the breaks. Anyway, I was going to explain how to do it, but David Shaw just did. :-) Good luck PSM -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 252 bytes Desc: OpenPGP digital signature Url : /pipermail/attachments/20070406/ed4d3cc1/attachment-0001.pgp From yochanon at localnet.com Fri Apr 6 19:55:11 2007 From: yochanon at localnet.com (John B) Date: Fri, 6 Apr 2007 12:55:11 -0500 Subject: Un-revoking a key pair In-Reply-To: <20070406144817.GA10529@jabberwocky.com> References: <200704060122.52280.yochanon@localnet.com> <20070406144817.GA10529@jabberwocky.com> Message-ID: <200704061255.11468.yochanon@localnet.com> On 06 April 07 09:48, David Shaw wrote: > On Fri, Apr 06, 2007 at 01:22:52AM -0500, John B wrote: > > Hi gang, > > > > Somehow the other night I accidently imported a revoking thing for > > my main secret and public key pair when I was using kgpg. Kgpg tells > > me I need to un-revoke it in the manual editor, so, could someone > > tell me a quick and easy way to do so, please? Is it possible to > > un-revoke? > > Yes it is possible. The first thing is that you must not distribute > the keys while they are in this revoked state: do not send them to > anyone, and absolutely do not send them to a keyserver. > > Here's how to unrevoke. It's a very manual process. Be safe: make a > backup before you do stuff like this. > > 1) Export the public key into a file. > gpg --export (thekey) > mykey.gpg > > 2) Split it into parts: > gpgsplit mykey.gpg > > This breaks the key into multiple files with names like > "000001-006.public_key". > > 3) Figure out which packet is the revocation. It's likely to be > "000002-002.sig", but make sure with: > gpg --list-packets 000002-002.sig > > That will show information about the packet. If the sigclass is > set to 0x20, that's the revocation. Delete that file. > > 4) Put the key back together again: > cat 0000* > myfixedkey.gpg > > 5) Remove the old key: > gpg --expert --delete-key (thekey) > > You need --expert here so GPG will let you delete the public key > when a private key is still around. > > 6) Import the new key: > gpg --import myfixedkey.gpg Thanks to David, Peter, and Adam for the info on doing this. It looks like the easiest thing to do is go ahead and send out the revoked key info to keyservers and just make a new key though, especially since kgpg is acting up so badly and not seeing /home/me/.gnupg for some reason. Maybe I'll be able to figure it out before I create a new keypair though. Thanks again. From chris at aquanuke.com Sat Apr 7 03:50:43 2007 From: chris at aquanuke.com (womble) Date: Fri, 6 Apr 2007 18:50:43 -0700 (PDT) Subject: Using GNUPG with php scripts and webserver Message-ID: <9880555.post@talk.nabble.com> Hi I cant get php scripts from Apache to execute GNUPG comands. I figure its a USER problem. If I run cmds or execute php scripts from the cmd line that works fine. Im running Cpanel with PHP Version 5.2.0 Apache is running as nobody, and in /etc/passwd I have nobody:x:99:99:Nobody:/:/sbin/nologin I tried changing that to nobody:x:99:99:Nobody:/home/nobody:/bin/bash so that I could su to nobody and do gpg --import KEY and set the trust but even after that I still couldnt run any PHP scripts from the browser. Anyone give me a step by step how to set up GNUPG with PHP in a browser. Thanks -- View this message in context: http://www.nabble.com/Using-GNUPG-with-php-scripts-and-webserver-tf3539510.html#a9880555 Sent from the GnuPG - User mailing list archive at Nabble.com. From chris at aquanuke.com Sat Apr 7 05:51:41 2007 From: chris at aquanuke.com (chris at aquanuke.com) Date: Sat, 7 Apr 2007 04:51:41 +0100 Subject: Using GNUPG with php scripts and webserver References: <9880555.post@talk.nabble.com> Message-ID: <005a01c778c8$0f65a360$6401a8c0@poopee28629476> Thanks I have this in the error log gpg: fatal: can't create directory `//.gnupg': Permission denied secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768 gpg: fatal: can't create directory `//.gnupg': Permission denied secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768 ----- Original Message ----- From: "Stef Caunter" To: "womble" Cc: Sent: Saturday, April 07, 2007 3:53 AM Subject: Re: Using GNUPG with php scripts and webserver > Check error_log for the problem (if you can) - permissions on ~/.gnupg > files will cause things to not work and you must have environment exported > for the nobody user. I reset $ENV{'HOME'} in perl... there must be > something similar in php. If you can view the environment the server > provides in the browser you can see if you have what gpg requires. I > assume the binary is in $PATH for the webserver. Keys must be readable and > implicitly trusted for the webserver user and this user must have > somewhere to write if you are using temporary files. > > Stef > http://caunter.ca/crypto.html > > On Fri, 6 Apr 2007, womble wrote: > >> >> Hi I cant get php scripts from Apache to execute GNUPG comands. >> >> If I run cmds or execute php scripts from the cmd line that works fine. >> > >> >> nobody:x:99:99:Nobody:/home/nobody:/bin/bash >> > > From stef at caunter.ca Sat Apr 7 04:53:18 2007 From: stef at caunter.ca (Stef Caunter) Date: Fri, 6 Apr 2007 21:53:18 -0500 (EST) Subject: Using GNUPG with php scripts and webserver In-Reply-To: <9880555.post@talk.nabble.com> References: <9880555.post@talk.nabble.com> Message-ID: Check error_log for the problem (if you can) - permissions on ~/.gnupg files will cause things to not work and you must have environment exported for the nobody user. I reset $ENV{'HOME'} in perl... there must be something similar in php. If you can view the environment the server provides in the browser you can see if you have what gpg requires. I assume the binary is in $PATH for the webserver. Keys must be readable and implicitly trusted for the webserver user and this user must have somewhere to write if you are using temporary files. Stef http://caunter.ca/crypto.html On Fri, 6 Apr 2007, womble wrote: > > Hi I cant get php scripts from Apache to execute GNUPG comands. > > If I run cmds or execute php scripts from the cmd line that works fine. > > > nobody:x:99:99:Nobody:/home/nobody:/bin/bash > From j.lysdal at gmail.com Sat Apr 7 12:07:34 2007 From: j.lysdal at gmail.com (=?ISO-8859-1?Q?J=F8rgen_Christiansen_Lysdal?=) Date: Sat, 07 Apr 2007 12:07:34 +0200 Subject: Un-revoking a key pair In-Reply-To: <20070406144817.GA10529@jabberwocky.com> References: <200704060122.52280.yochanon@localnet.com> <20070406144817.GA10529@jabberwocky.com> Message-ID: <46176D66.7010003@gmail.com> David Shaw wrote: > 1) Export the public key into a file. > gpg --export (thekey) > mykey.gpg > > 2) Split it into parts: > gpgsplit mykey.gpg > > This breaks the key into multiple files with names like > "000001-006.public_key". > > 3) Figure out which packet is the revocation. It's likely to be > "000002-002.sig", but make sure with: > gpg --list-packets 000002-002.sig > > That will show information about the packet. If the sigclass is > set to 0x20, that's the revocation. Delete that file. > > 4) Put the key back together again: > cat 0000* > myfixedkey.gpg > > 5) Remove the old key: > gpg --expert --delete-key (thekey) > > You need --expert here so GPG will let you delete the public key > when a private key is still around. > > 6) Import the new key: > gpg --import myfixedkey.gpg What is the reason for doing all this, when you can just delete the revocation signature? From j.lysdal at gmail.com Sat Apr 7 12:10:35 2007 From: j.lysdal at gmail.com (=?ISO-8859-1?Q?J=F8rgen_Christiansen_Lysdal?=) Date: Sat, 07 Apr 2007 12:10:35 +0200 Subject: Un-revoking a key pair In-Reply-To: <20070406144817.GA10529@jabberwocky.com> References: <200704060122.52280.yochanon@localnet.com> <20070406144817.GA10529@jabberwocky.com> Message-ID: <46176E1B.7080107@gmail.com> J?rgen Ch. Lysdal wrote: > What is the reason for doing all this, when you can just delete the > revocation signature? Okay I was thinking uid?s here... From g_sauthoff at web.de Sat Apr 7 20:01:38 2007 From: g_sauthoff at web.de (Georg Sauthoff) Date: Sat, 7 Apr 2007 18:01:38 +0000 (UTC) Subject: Using multiple subkeys in GPG Message-ID: Hi, after reading the mini-howto 'Using multiple subkeys in GPG' http://fortytwo.ch/gpg/subkeys I am curious, if someone uses a setup like this for his/her insecure workplace. Because the howto is outdated my questions are: - does gpg > 1.4 still have the 'problems' descibed in the howto? - does keyservers like subkeys.pgp.net or pgp.mit.edu have problems with updating and managing my already submitted keys, if I a add a subkey? - what about support for encrypting/decrypting in programs like mutt? Best regards Georg Sauthoff PS: I have looked over the last ~2000 mails of this list, but didn't find a thread about this subject. From gpglist at umbra-obscura.de Sat Apr 7 20:30:41 2007 From: gpglist at umbra-obscura.de (Alexander Feigl) Date: Sat, 7 Apr 2007 20:30:41 +0200 Subject: Gnupg cannot handle extremely large keys on 32 bit Linux Message-ID: <200704072030.42438.gpglist@umbra-obscura.de> Hi gnupg 2.x seems to have problems with importing extremely large keys on 32 bit Linux. (>= 16kbit RSA) While an sensible error message might be acceptable when support for such large keys is not desired, the current behaviour certanly isn't. gnupg 2.0 imports the key but when listing the key it appears under another key id and fingerprint and the key expiry date is not shown. Other data might be corrupted too. I tested it with gnupg 2.0.3 under Gentoo Linux. Once on a 64 bit AMD CPU, once on a 32 bit AMD CPU. Besides everything is compiled for 64 bit/32 bit the machines should be rather identical. 64 bit seems to work without problems but 32 bit shows this incorrect behaviour. Gnupg 1.x seems to work on both CPUs. Is this problem reproducable on other distributions or does a compiler bug cause these problems. I pasted a testing key below. The key with the key id 0x2D879666 gets imported as 0xB61454A3 here. While such large keys seem like overkill. But gnupg also supports the SHA512 hash which would require such large keys for sensible use. Alexander Feigl -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.3 (GNU/Linux) mQgNBEYXfA4BQACW9BfJWcU6VikLdrfFgcSywbW9FD2Acd609cjJD1vOC8daOKdN Wawq5IQJ2f5MwNZE6xAGR/pZ61cjMw5pIZorN/+f6JurjWJBosNmkslAPa7jB240 4WdJKYRupThH/4zvjozb3mKeDFuMvk1sbHNadtZ3XQmqjPSp7EIwgA70vpmTWyZq 2DoanXjl1x+OhONAi0hjfh+I7YDn0eqDIHK4mmNCnAClkaEo2iDSeMEltH6mdv00 DPUQeGHQCp0JOdzqZc/dp+aO7al2Mi7WRq2ir4zVus49LhisH8rDRFJ5DJQ28qGJ wtj4sIg4/Sz6MsZG2hwMJVB4SMPnAOyBlPGt965d0jxDeXhZdDIV9yKvAiKFZcKH eYcoShhf4QwfX1KtmZ0ui6a01ipBkTe8floNTyXtvj7ub/k477eK7hQK3NijvUyz cQDVo7W1EwYR2i7cRc34Qaz4N3OevqxvBgFof8N+rVelWMYcqwbyoXD7mA9On5U8 /7wxUihJnhXm7GzSaClBeh9pV2fl3SRPZqe/EV3F15c29QMN3hY9wr45kmn6aE0E EMj90uATwiSToEbcranLAuY5KfmIRGz+CZ35N72EI6ibRNHKR72iRDwz9qlNQs3K Hv4Rf6vAieva5AG6ywUR7b9qrLm8vZabMx+w9vb1/8HjrWqOHIC5hzuE7kIZJrqM jiI8++PSd9vM7fITKFk0FMnVyyWDonKnDYQdZXuxZZRKaNCWz3uZOx9f1daAsQk5 hN9x4QjxwbSUUc9tegkTb0ZfLYnBhyTkASl4K40s0rI+PAjeOiLcpGSZPMCuT1Wm H8AYiVwnzmkn55sQq2NrgjLeMxjTunO9/u+49nuRYNTZEK+NsXhXq/Lfhr1SPNRU 7V2kixRrlgT0mZIzCSPRKq1CXT4O4lLGEwKo0yjntVlqdiS2N8MyPI25/yRpRrSU dfCMAPWzkWuzdYHcIpLIt2px8gHiWxW8EQsgHIURSZ3G0O3IKkC00Vzs2RyHeaPV TJ96L9Mq3i+WkKiTKyq3gjkTXDFbSI4sfINkxhaBF/M81Za57dM+5i8i8i1K32E8 r8grc3VibFDx53uqTEsMSqrgeVufHKB5b1KCOOiMBrC69in/Gpx8Jr73/JzUYiha 9rO7Z2Z5XCWY3IZt1j/5Da2oH44/wxYwHippLPIRJn137852tM63OBiZ+sneLLGe fzuP0fKoB2On1ok81sbz+Gniq0kGdBwnqVboM9nsO70QPgNKLakydH4JWARvG6Zg 4Xhu6q3crO2mW9ueqW+uye1JMzP+GnMmgmSOwZ9q2KMmflRN8TYFiiUfC/L8V5Az U95UPf0ZQKPbx4jd00hxhezOEsdOccv6VBstSjfal22XcHc8QBLVTPdRI7PFHJ7N Aikk9l9pe1W5FM79aJZE+uQPGgi26ZZJPWhNrSMgeOADbNadKy7a93qLN/A89rSM etQLMxJ904FVQ9nA1i5f4HlF6nIncyyWdLlXxQNH6r/sezZnyX5d7at77u4UyFbI Q9B91qmQ5bNInks6HZU/4Vw5H9lJgf8lGnMdJPzqP9kfuF+yuAkynDhPeWLLZ/qH e0ZRUikTt7bt6hw4KH4URrEYMNc++0Ha5b8Wz1dFonxIBrNMabtdRpcFgvVNlBRc iZvKS3LQYp67dvhJNVRCB3W2it7ObmKsfBgBUvAcADwOAfbBfOd//gzswHhvuFyN sicOrnSqCLe2dMeDGNcAuUsGYe4wIjrbH+mEIXxkuuAGjLvv8h7XEhLXfNmUUFQG kD/niMVWHJksUcXk6pl4GwaMIH52dk59i2LzC5rZ49OkOmUZR2lWDwPH5q4fPGP7 KXk2aoMVcayOfE65vZ2+rC/K+zQ7otr9htp0u05lUrfCMUGoBR0OvQFKUX/2kn0U IHivyHD