Subject: Re: Cleartext Signatures

From: [email-masked] (Daniel A. Nagy)
Date: Mon, 10 Oct 2005 18:20:36 +0200

On Mon, Oct 10, 2005 at 03:30:29PM +0100, Ben Laurie wrote:

> That mantra has shown to be a less than great idea recently, since it 
> promotes interestingly obscure security holes, so I still would like to 
> know what the correct behaviour is, and I'd like the I-D to accurately 
> document that behaviour.

In that case, the empty line should be mandated, although distinguishing
between header data and base64 armor is quite straightforward and
unambiguous: headers always have colons in them, base64 armor never does.
Thus, it should be impossible to derail a correct parser with a carefully
constructed header, though of course, it's easier to write the parser if one
assumes an empty line before the base64 data.

-- 
Daniel

---

From: Ben Laurie <[email-masked]>
Date: Mon, 10 Oct 2005 18:58:03 +0100

Daniel A. Nagy wrote:
> In that case, the empty line should be mandated,

I agree.

> although distinguishing

This becomes less straightforward when you hit line length limits.

> assumes an empty line before the base64 data.

Mine does either (configurably).

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: David Shaw <[email-masked]>
Date: Tue, 11 Oct 2005 18:24:04 -0400

> >In that case, the empty line should be mandated,

As do I, but it seems to me that it is already mandated.  Section 6.2
(Forming ASCII Armor) mandates the line.  Section 7 (Cleartext
signature framework) refers to "The ASCII armored signature(s)".
Doesn't it them follow that the armored signature (like all armor)
mandates the line?  Am I reading into something that isn't there?

David

---

From: Ben Laurie <[email-masked]>
Date: Wed, 12 Oct 2005 10:32:19 +0100

> mandates the line?  Am I reading into something that isn't there?

I guess careful reading supports this, but the fact that it explicitly 
mentions Header and Tail Lines but _not_ the headers is confusing.

Also, it seems quite a few implementations miss them out, so I'm not the 
only confused one.

Cheers,

Ben.