Subject: Problems with calculating signatures over keys

From: Kimmo Mäkeläinen <[email-masked]>
Date: Thu, 26 May 2005 10:20:43 +0300

I'm trying to compute the signature over the DSA key and I'm rather 
confused.

I have generated DSA and El Gamal keys with Gnu Privacy Guard software.

First, how many octets there should be in the user id packet to define the 
length of the username?

It is said in the 5.2.4 that
"A V4 certification hashes the constant 0xb4 (which is an
   old-style packet header with the length-of-length set to zero), a
   four-octet number giving the length of the username, and then the
   username data."

However, in the key generated by GnuPG the length is given with only one 
octet. I have used the PGPdump interface (http://www.pgpdump.net) to 
visualize the key data, and the interface shows the data correctly, 
including the user id packet.

Here is the key packet:

The "raw" data of the key is attached to this message.

My main problem is that I can't calculate the correct hash value. PGPdump 
shows that the two left bytes of the calculated hash value over the 
keypacket + user id packet + signature packet are 0xE8 and 0xA4.

In 5.2.4 is also said that

"V4 signatures also hash in a final trailer of six octets: the version
   of the signature packet, i.e. 0x04; 0xFF; a four-octet, big-endian
   number that is the length of the hashed data from the signature
   packet (note that this number does not include these final six
   octets."

I haven't found an unambiguous explanation for the length bytes. Is it the 
length of the whole data being hashed (from the public key packet through 
the end of the hashed subpacket data of signature packet) or just from the 
version number of the signature packet through the end of hashed subpacket 
data?

I have studied old messages from the mailing list. For example in 
http://www.imc.org/ietf-openpgp/mail-archive/msg02966.html the structure of 
the explained like this:

(header data)
0x99
2 octet length
key packet body data

(user id data)
0xb4
4 octet length
username data

(signature trailer)

version field to end of hashable data

V4 signature trailer
0x04
0xFF
4 octet length

I think the structure is otherwise clear, but what should be done with the 
length of the user name? If I add three bytes to the key generated with the 
GnuPG, I still can't get the hash value to match with the two bytes GnuPG 
has calculated.

Best regards,
Kimmo Mäkeläinen

_________________________________________________________________
3 vrk:n sääennuste http://www.msn.fi/uutiset/saa

---

From: [email-masked] ("Hal Finney")
Date: Tue, 31 May 2005 08:51:13 -0700 (PDT)

I sent Kimmo private mail from on the road showing a problem:

> Thanks for the clarification, but I still can't get the right resuts. I 
> tried to calculate like this:
>
> SHA1(0x99 (public key tag)+ 0x01 + 0xA2 (key length) + Key packet (418 
> bytes) + 0xB4 (user id tag) + 0x00 + 0x00 + 0x00 + 0x28 (user id length) + 
> User Id packet (40 bytes) + 0x04 + 0x13 + 0x11 + 0x02 + 0x00 + 0x1E + 0x05 + 
> 0x02 + 0x42 + 0x95 + 0x6E + 0xD1 + 0x02 + 0x1B + 0x03 + 0x06 + 0x0B + 0x09 + 
> 0x08 + 0x07 + 0x03 + 0x02 + 0x03 + 0x15 + 0x02 + 0x03 + 0x03 + 0x16 + 0x02 + 
> 0x01 + 0x02 + 0x1E + 0x01 + 0x02 + 0x17 + 0x80 + Trailer: 0x04 + 0xFF + 0x24 
> (big endian length of hashed data from the sign. packet) + 0x00 + 0x00 + 
> 0x00)

The last four bytes should be 00 00 00 24 not 24 00 00 00.  It is supposed
to be the length of hashed data from the signature packet, which is hex
24, in four octet big-endian form.  He sent back that this fixed the
problem.

I do like the idea of an "implementation examples" document but I am not
sure I am the right person to do it, due to time demands.  I'll talk to
the management at work and see if this is something that I or someone
else could get some time to prepare in the next few weeks or months.

Hal Finney