Subject: Secure mailing list service using OpenPGP

From: "X“c ¹G" <[email-masked]>
Date: Wed, 27 Jan 1999 13:37:11 +0900

Hi,

I want to discuss about secure mailing list service using OpenPGP.

I have developed a secure mailing list service by extending an existing
mailing list server, FML 2.2 (see
http://www.sapporo.iij.ad.jp/staff/fukachan/href/fml/index-e.html). The
patch to the original source code will be released in a few weeks.

Using this extention, a member of a secure mailing list service can sends a
message encrypted to the public key of the server, and the destribution of
the message is also encrypted. The server decrypts the message and encrypts
to the all public keys of the members of the list. Then the server delivers
the re-encrypted message to the members.

In the current implementaiton, the server clips a message from an armor
header line, BEGIN PGP MESSAGE to an armor trailer line, END PGP MESSAGE,
and pipes the clipped message to decrypt and encrypt programs, then replaces
the original message with the re-encrypted one. The server also adds a
signature when re-encrypting to identify the mailing list server.

One problem in this implementation is authentication of the original message
sender. The server removes original sender's signature attached to an
encrypted message when replacing an original message with the re-encrypted
message. This is because PGP decrypt program, pgpv, strips the signature
when it decrypts the message.

Another problem is comformance to OpenPGP/MIME specification proposed by
K.Yamamoto[OpenPGP/MIME]. For example, if an original message is using
'Encrypted-then-Signed' service, the current implementation replace the
inner multipart/encrypted MIME object and this makes impossible to verify
the signature in the outer multipart/signed MIME object.

Currently, I don't have the solutions for these problems. I'm just starting
to grapple with them. I will welcome to your comments.

[OpenPGP/MIME] K.Yamamoto. MIME Security with OpenPGP. Internet Draft. Dec,
1998.

--- Masahiro Morita, NTT Information Sharing Platform Laboratories.

---

From: "William H. Geiger III" <[email-masked]>
Date: Wed, 27 Jan 1999 00:37:28 -0500

In <[email-masked]>, on 01/27/99 

>Currently, I don't have the solutions for these problems. I'm just
>starting to grapple with them. I will welcome to your comments.

Signature retention is a big issue that I have been involved with on both
the PGP/MIME and now the OpenPGP working groups. Basically there are two
ways to accomplish this:

NON-MIME Approach:

The original sender of the message clearsigns the message then encrypts
the message (a two step process). This way the server decrypts &
re-encrypts the message and the signature is retained.

MIME Approach:

The original sender OpenPGP/MIME signs the message then OpenPGP/MIME
encrypts the message (again a two step process).

Unfortunately few mailers/plugins are designed to use this approach when
singing & encrypting a message. Instead they use the sign & encrypt
approach (one step process) which signature retention is not possible
after decryption.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
---------------------------------------------------------------

---

From: "森田 昌宏" <[email-masked]>
Date: Wed, 27 Jan 1999 15:54:04 +0900

> approach (one step process) which signature retention is not possible

That's right.

I've read OpenPGP Message Format specification and I think that it is
logically possible to decrypt a signed&encrypted message and to extract the
message together with the signature. Is this correct?

If this is true, we can build a program to do this process and to re-encrypt
to recipients of a ML.

However, which approach should we take in? Geiger's two step approach with
prohibiting the usual one step sign&encrypt process, or my approach
described above? --hiro

--- Morita Masahiro, NTT Information Sharing Platform Laboratories.

---

From: Thomas Roessler <[email-masked]>
Date: Wed, 27 Jan 1999 09:44:29 +0100

On 1999-01-27 15:54:04 +0900, ?$B?9ED?(B ?$B>;9(?(B wrote:

> However, which approach should we take in? Geiger's two step
> approach with prohibiting the usual one step sign&encrypt process,
> or my approach described above? --hiro

As long as you don't want to use "clearsigning", you can try to
extract the signature from the "signed+encrypted" stuff.  Anyway,
doing this will require some patches to the PGP version you are
using.

tlr
-- 
Thomas Roessler · 74a353cc0b19 · dg1ktr · http://home.pages.de/~roessler/
     2048/CE6AC6C1 · 4E 04 F0 BC 72 FF 14 23 44 85 D1 A1 3B B0 73 C1
> Hi!  I'm Signature Virus 99!  Copy me into your signature and join the fun!

---

From: "X“c ¹G" <[email-masked]>
Date: Thu, 28 Jan 1999 13:19:14 +0900

> when it decrypts the message.

Many people advised me about this issue. Thanks > everyone.
I think that the best way is modifying pgpv to stop the decryption process
after finding an encrypted message and re-encrypting the message with the
original signature.

Is this modification easy?

> the signature in the outer multipart/signed MIME object.

I think that this issue needs to define standard processes of this kind of
mailing list agents.
I mean, for example, if a signed-then-encrypted message is posted to a
mailing list, the mailing list agent should decrypt and re-encrypt to the
members, then the agent may sign to it. Or, if a encrypted-then-signed
message, the agent can eliminate the signature and decrypt&re-encrypt, and
so on.

In S/MIME, an I-Draft, "Enhanced Security Services for S/MIME" describes
secure mailing list services and defines the standerd process of mailing
list agents. We need the definitions like it for OpenPGP, don't we? --hiro

---

From: "Masahiro Morita" <[email-masked]>
Date: Thu, 28 Jan 1999 15:00:11 +0900