MDC and GnuPG as a filter

Gordon Worley redbird@rbisland.cx
Tue Aug 13 02:30:02 2002


On Monday, August 12, 2002, at 09:59  AM, Florian Weimer wrote:

> It looks as if an application should start processing the decrypted
> data only after the MDC packet has been verified.  (Have a look at
> this paper: http://www.counterpane.com/pgp-attack.html -- most of you
> probably know it already.)
>
> Unfortunately, this breaks one-pass processing for OpenPGP data.  The
> whole plaintext has to be stored, and in general, processing can only
> begin after all data has been received. :-(
>
> Or am I missing something?

Having read the paper, I'm wondering, how can I check for this via 
GPGME.  Will GPGME provide an error if the MDC packet does not verify (I 
couldn't find one that it might return)?

--
Gordon Worley - Mac GPG Project
http://macgpg.sourceforge.net/              ``Doveriai no proveriai.''
redbird@rbisland.cx                                --Russian proverb
PGP:  0xBBD3B003