Subject: Re: some requests

From: Florian Weimer <[email-masked]>
Date: 09 Feb 2001 19:24:18 +0100

Thomas Roessler <[email-masked]> writes:

> I suppose that your preferred solution would be to mandate
> binary-mode signatures, so there is no need to give extra protection
> to trailing whitespace.  However, specifying this would mean that
> most current implementations don't conform to the spec, unless I'm
> severely mistaken.  Florian?

IMHO, the best solution is to use a new signature type (i.e. signature
on a MIME part) in RFC 2440bis:

   0x41: Signature of a MIME part.
       This means the signer owns it, created it, or certifies that it
       has not been modified.  The signature is calculated over the
       text data with its line endings[1] converted to <CR><LF> and
       trailing blank characters on each line removed.  Trailing blank
       lines are also removed.

Otherwise, we have to deal with this kind of problems for years.

[1] See comment in the next article.

-- 
Florian Weimer 	                  [email-masked]
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898

---

From: Florian Weimer <[email-masked]>
Date: 09 Feb 2001 19:18:01 +0100

Thomas Roessler <[email-masked]> writes:

>   Note: If any line begins with the string "From", it is strongly
>   suggested that either the Quoted-Printable or Base64 MIME encoding
>   be applied.  If Quoted-Printable is used, at least one of the
>   characters in the string should be encoded using the hexadecimal
>   coding rule.  This is because many mail transfer and delivery
>   agents treat "From " (the word "from" followed immediately by a
>   space character) as the start of a new message and thus insert a
>   right angle-bracket (>) in front of any line beginning with "From"
>   to distinguish this case, invalidating the signature.

Perhaps you can add the following text?

  If neither the Quoted-Printable nor Base64 MIME encoding is used,
  and the charset provides alternative encodings of ASCII characters,
  at least one characters in the string "From " shall be encoded in
  such a way.  Alternatively, if the charset provides (control)
  characters without visible or semantic effect, such characters shall
  be used to make the ASCII representation of the beginning of the
  line distinct from "From ".

AFAIK, ISO-2022-JP provides such noop characters (and UTF-7 provides
an alternative encoding for ASCII characters, with UTF-8, you could
use the BOM---which is, unfortunately, not without semantic effect,
but that's a Unicode design problem anyway).  This way, one of the
main problems which requires mandated Quoted-Printable encoding can be
addressed by ISO-2022-JP users, even if they use a 7bit CTE.

BTW: I've recently seen a line starting with "from " which was
mangled.  Your text does not indicate if

---

From: Kazu Yamamoto (山本和彦) <[email-masked]>
Date: Sat, 10 Feb 2001 11:59:54 +0900 (JST)

From: Florian Weimer <[email-masked]>
Subject: Re: some requests

> addressed by ISO-2022-JP users, even if they use a 7bit CTE.

Such encoding is possible. But I think redundant escape sequence is a
bad idea.

All in all, the problem of "From " is NOT a PGP/MIME issue, but a
Multipart/Signed issue (which covers PGP/MIME, S/MIME, MOSS). If
people want to include such a language, it should go to RFC 1847bis.

--Kazu

---

From: Florian Weimer <[email-masked]>
Date: 11 Feb 2001 15:18:55 +0100

> Such encoding is possible. But I think redundant escape sequence is a

Do you have a better suggestion?  Either the CTE has to take care of
"From " lines, or the charset.  I don't see many options here.

> people want to include such a language, it should go to RFC 1847bis.

Is a revision of RFC 1847 underway?  IMHO, it's better to deal with
these things now and mention them in OpenPGP/MIME (the strictness of
these requirements is perhaps open to debate, but the problems should
be mentioned and a set of possible solutions should be presented).

---

From: Thomas Roessler <[email-masked]>
Date: Mon, 12 Feb 2001 11:42:08 +0100

On 2001-02-09 19:24:18 +0100, Florian Weimer wrote:

> IMHO, the best solution is to use a new signature type (i.e.
> signature on a MIME part) in RFC 2440bis:

This won't help us, either.  After all, the "new-style" text-mode
signatures are nicely adapted to what we need with PGP/MIME.  The
problem is that we have incompatible text-mode signatures _now_.

-- 
Thomas Roessler			    <[email-masked]>