Subject: Re: PGP/MIME implementors: text mode vs. binary mode?

From: [email-masked]
Date: Tue, 13 Feb 2001 09:19:37 -0800

Thomas, Roessler <[email-masked]>, writes:
> Now, for PGP/MIME, this turns into a really ugly problem: RFC 2015
> does not specify which kind of signature to use. However, it does
> specify how the signed material should be canonicalized before
> hashing.

I don't fully understand what you are saying here.  When you talk about
"what kind of signature to use", are you referring SOLELY to the value of
the signature-type byte within the signature packet?  This is the byte
which is described in RFC2440, section 5.2.1, as 0x00 for a signature
of a binary document, and 0x01 for a signature of a text document.

Is this the ONLY question as issue, what value to put into this byte?

Or, is there a separate question: what exactly should be hashed?

Above you say that RFC2015 specifies how the signed material should be
canonicalized before hashing.  If this is true, then the second question
is not at issue, because you'd have a precise specification of what
exactly should be hashed, for any given PGP/MIME message.

However I don't see that RFC2015bis does precisely specify what is hashed.
In section 5, it describes some canonicalization rules, and then says,

   (4)  As described in [2], the digital signature MUST be calculated
        over both the data to be signed and its set of content headers.

(where [2] is RFC1847, Security Multiparts for MIME).

This does not explicitly describe what is hashed.  Rather, it describes a
pre-processing step before calculating a digital signature over the data.
The question of what is hashed would then depend on what the signature
engine does to the data AFTER you have prepared it as described in
RFC2015.

In that case, the second question above, "what exactly should be hashed"
is an open one.

Could you clarify which of these questions is/are at issue?

Hal Finney

---

From: Thomas Roessler <[email-masked]>
Date: Tue, 13 Feb 2001 19:32:55 +0100

On 2001-02-13 09:19:37 -0800, [email-masked] wrote:
>> Now, for PGP/MIME, this turns into a really ugly problem: RFC
>> 2015 does not specify which kind of signature to use. However,
>> it does specify how the signed material should be canonicalized
>> before hashing.

[...]

> In that case, the second question above, "what exactly should be
> hashed" is an open one.

> Could you clarify which of these questions is/are at issue?

With traditional PGP, a text mode signature means that PGP
canonicalizes line endings, and then calculate the hash over the
result.  A binary signature would just hash the raw data.

With OpenPGP, a text mode signature means that the implementation
strips trailing white space, canonicalizes line endings, and
caluclates the hash over the result.

Obviously, these text signatures are based on different hash values
as soon as any trailing white space is involved.

Now, what RFC 2015 does is to pre-canonicalize the signed material
in a way which lets the distinction between binary and
(traditional!) text mode signatures disappear, as far as the hashes
are concerned. Thus, a verifier can calculate a single hash without
knowing about the kind of signature, and then verify the signature
when it's encountered in the input stream.

My suggestion was now to mandate one of the signature modes, and
thus one way to hash the data.  However, as Bodo pointed out
correctly, it's most likely more reasonable to put in a further
restriction on the signed data, and leave the binary vs text
question unspecified.

-- 
Thomas Roessler			    <[email-masked]>