Re: Question about verifying signatures
Stephen Paul Weber <singpolyma@singpolyma.net> Wed, 31 March 2010 01:46 UTC
Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id o2V1kp8p042912 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 30 Mar 2010 18:46:51 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org)
Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id o2V1kppe042911; Tue, 30 Mar 2010 18:46:51 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org)
X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f
Received: from mail-vw0-f43.google.com (mail-vw0-f43.google.com [209.85.212.43]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id o2V1knPR042904 for <ietf-openpgp@imc.org>; Tue, 30 Mar 2010 18:46:50 -0700 (MST) (envelope-from singpolyma@gmail.com)
Received: by vws6 with SMTP id 6so3314182vws.16 for <ietf-openpgp@imc.org>; Tue, 30 Mar 2010 18:46:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:date:from:to:cc :subject:message-id:references:mime-version:content-type :content-disposition:in-reply-to:jabber-id:openpgp:x-url:user-agent; bh=zLTkPx5j9Ivi8eykm8Q4gmqkG/1TKV4e+8J67wO8y6w=; b=Zj2oZKjJxwdGJLLUfHA/GsPJfRr/rj0Cz9rEZ6puMihcJeS9ANzMM6WIj560YVFkmc aW/FJaLeWFhr9yiwxYvW7UlkQr7gEt0VVfRnIgOm9bKoWbJwpqwr5b/u2/KT9xoHLpTb xMAdyMkc75NXf4hEwyXQcJF3WWEo/qiXmhuYw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:jabber-id:openpgp :x-url:user-agent; b=DJcx2qrQCvS5CIdkwFAy2dIEQ85/8wpzPSVrlaYBE2Z6COhMnFLxlbabSnrw0owteS gNtZr3/A5OWY9pPvCUc6fFd0niwAgFKRj7/Be8HPpRG2q6aQML1XjGUaKar6ribdnnJ2 BWcOAyvXWxC17xiToZ3SIPYuhCkrXCxGSyDKY=
Received: by 10.220.62.77 with SMTP id w13mr353620vch.202.1270000008853; Tue, 30 Mar 2010 18:46:48 -0700 (PDT)
Received: from localhost ([66.49.154.250]) by mx.google.com with ESMTPS id 34sm132118109vws.8.2010.03.30.18.46.46 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 30 Mar 2010 18:46:47 -0700 (PDT)
Date: Tue, 30 Mar 2010 20:46:52 -0500
From: Stephen Paul Weber <singpolyma@singpolyma.net>
To: Wim Lewis <wiml@hhhh.org>
Cc: ietf-openpgp@imc.org
Subject: Re: Question about verifying signatures
Message-ID: <20100331014652.GA5715@mediacentre>
References: <20100330202049.GA21672@mediacentre> <Pine.NEB.4.64.1003301503480.14845@photomat-new.hhhh.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; x-action="pgp-signed"
Content-Disposition: inline
In-Reply-To: <Pine.NEB.4.64.1003301503480.14845@photomat-new.hhhh.org>
Jabber-ID: singpolyma@gmail.com
OpenPGP: id=CE519CDE; url=https://singpolyma.net/public.asc
X-URL: https://singpolyma.net
User-Agent: Mutt/1.5.20 (2009-06-14)
Sender: owner-ietf-openpgp@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-openpgp/mail-archive/>
List-Unsubscribe: <mailto:ietf-openpgp-request@imc.org?body=unsubscribe>
List-ID: <ietf-openpgp.imc.org>
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Somebody claiming to be Wim Lewis wrote: > I agree that paragraph isn't completely unambiguous. IIRC, the data > passed to the SHA1/MD5/whatever algorithm is the bare document > contents (possibly with EOL canonicalization as described above), > concatenated with some "trailer" bytes which depend on the version > number of the signature, but are a copy of part of the signature > subpacket itself plus perhaps a length field and so on (see the last > three paragraphs of [5.2.4]). So, I'm concatenating: * The literal contents of any literal data packet(s). * The literal bytes of the signature packet up to and including the "hashed" subpackets * 0x04 * 0xFF * The length of the second thing in this list As the "message" to hash? I'm going to try that. - -- Stephen Paul Weber, @singpolyma Please see <http://singpolyma.net> for how I prefer to be contacted. edition right joseph -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iQIcBAEBCAAGBQJLsqmMAAoJENEcKRHOUZzezXEQAKs9UZu6GBYlhAyeBnfFOKLK jYoh03l6NoeNGK9LW2NHVFPgasg+NW3hNNoc2F/ZcyxX9t9HUDliNH+eINyWIUao SHTO1oCiO+DcJu12HZgbAVIp7KkYXhcXJB9ql5dEJo5Ux0xAXTAf5r3Cjn2C5fvS gzCJRezT7UQp30h/PlWs0RgF3/Vn3re/EuDO4SGdtYuVl73mB2zSB2TXHRBbJD97 79ZqzZQLYGQ81MRZ5IBdGTy3kFHKCijrFfsDiWyqxddrKaU3qGluKDAzH7RD1rpY 9bfKnvFm0J0Pi2w9ZyIhO0/aZVqNqtfzhAFAjfaN6fX+Dla+/3uUNp+tCaHVNIhf 9LCxIpcw4i0QKmIUDM3o8ppxba8dm8mlfFJ0kuYjIJFrI4G4hEcoywEqmM6LO+9J uchOHAtNl8g9mixnG2Q+TSd1CrDqpyL2Y/xGfDH2enSU/Lic68uFs9mGMeLYNMdT Yru4J/NxVS9G+bCD3mmnie7wZBeUsJdbYRhRZJPglAJNhGxDljpGakHeDN9fvTCA FtKTsCBATvhho41Q5wig9guMbZYKD2DQQwvXx7QGy2DM/SnAncAKM1dP7xQgtwhX s8ytm6L5LTH4OCTaMdSsZoigwympU9oh+ACnic6Z8uRvPLDyZFvGFSRkWPy943kr mbrIKJFPQb+ND2Kf1hqv =x0Q1 -----END PGP SIGNATURE-----
- Re: Question about verifying signatures Stephen Paul Weber
- Re: Question about verifying signatures David Shaw
- Re: Question about verifying signatures Stephen Paul Weber
- Re: Question about verifying signatures Wim Lewis
- Question about verifying signatures Stephen Paul Weber