Subject: Re: Forbidding 8bit text in Armor comments

From: Thomas Roessler <[email-masked]>
Date: Thu, 2 Aug 2001 19:26:03 +0200

On 2001-08-02 17:25:49 +0100, Ian Bell wrote:

>If utf-8 is allowed in Comments then RFC2015bis will need to be 
>amended (if it hasn't got through last call yet) to tell clients 
>what to do with it before sending.

It has gone through last call.

>Double encoding is not a sensible option

No, of course not.

>- either say RFC2015bis clients MUST NOT include comments lines 
>with utf-8 characters, or say that RFC2015bis clients MAY drop 
>utf-8 comments lines, but if they don't they MUST RFC2047 encode 
>them.

This is plain silliness - just like double encoding. We are talking 
about a comment which is:

- hardly ever read by users, because it's not even on the 
   application layer
- mostly used to advertise the program which is used for generating 
   it to those who wonder what kind of "data junk" they are 
   receiving
- is not cryptographically protected
- and, when using utf-8 text, breaks assumptions which have been 
   made for years now, and, in fact, breaks the whole point ASCII 
   armor was designed for

The discussion we are having here is basically equivalent to 
discussing internationalization of SMTP greetings or User-Agent 
headers.

If you ask me, I'd just suggest to drop the Comment armor header. 
Since that's probably not an option, castrate it to 7bit characters.

-- 
Thomas Roessler                        http://log.does-not-exist.org/

---

From: Thomas Roessler <[email-masked]>
Date: Thu, 2 Aug 2001 19:41:52 +0200

On 2001-07-31 09:39:15 +0200, Werner Koch wrote:

>The solution is to use "gpg --comment '' ..." to disable the armor 
>commentline or use sed to cut it out later.

That's of course what I have added to mutt's default gnupg
configuration now.  BTW, it would be nice if it was possible to 
entirely disable that header with gnupg, which doesn't seem to be 
the case.

>So it is definitely not a standard problem.

I disagree.

It should be possible to rely upon the ASCII-armored text OpenPGP 
applications generate when creating e-mail messages or anything else 
which is supposed to cross system boundaries.  Armor should for that 
reason be invariant and robust under the usual kinds of character 
set conversions and corruptions.

After all, that's the entire point of ASCII-armor...

---

From: Thomas Roessler <[email-masked]>
Date: Fri, 3 Aug 2001 00:58:34 +0200

On 2001-08-02 19:41:52 +0200, Thomas Roessler wrote:

>BTW, it would be nice if it was possible to entirely disable that 
>header with gnupg, which doesn't seem to be the case.

Correction:  I mis-remembered this from the last time I looked at 
that code.  Thanks to John Kane for telling me that I was wrong 
about this, and apologies to Werner.

---

From: Werner Koch <[email-masked]>
Date: 03 Aug 2001 09:12:47 +0200

On Fri, 3 Aug 2001 00:58:34 +0200, Thomas Roessler said:

> Correction:  I mis-remembered this from the last time I looked at that
> code.  Thanks to John Kane for telling me that I was wrong about this,
> and apologies to Werner.

Anyway, I removed the default comment string, I don't think it does
make sense anymore.  --comment '' still works of course.

-- 
Werner Koch        Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH      et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions                                        -- Augustinus