Mailing List Archive

You, Keith Owens, wrote:

> The signature verifies using gnupg 1.0.2 and load-extension rsaref.
> It does not verify using stock gnupg 1.0.3, with or without rsaref.

Why do you use the rsaref module instead of the normal rsa module, which is
already integrated in gpg 1.0.3?

Maybe this comment from the rsaref.c source applies:

RSAREF is limited in key size and in the coding of the encrypted data.
Everything that passes through RSAREF must be coded in PCKS #1. The
GPG module interface places no such restriction on the module itself,
but fortunately it happens to pass PCKS #1 coded data in. It is
transparently decoded and recoded as necessary.

--
ir. J.C.A. Wevers // Physics and science fiction site:
johanw@vulcan.xs4all.nl // http://www.xs4all.nl/~johanw/index.html
PGP/GPG public keys at http://www.xs4all.nl/~johanw/pgpkeys.html

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org

On Sat, 30 Sep 2000 14:47:34 +0200 (MET DST),
Johan Wevers <johanw@vulcan.xs4all.nl> wrote:
>You, Keith Owens, wrote:
>
>> The signature verifies using gnupg 1.0.2 and load-extension rsaref.
>> It does not verify using stock gnupg 1.0.3, with or without rsaref.
>
>Why do you use the rsaref module instead of the normal rsa module, which is
>already integrated in gpg 1.0.3?

I repeat: It does not verify using stock gnupg 1.0.3, with or without
rsaref. I tried 1.0.3 without load-extension rsaref and it still
failed to verify.

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org

On Sun, 1 Oct 2000, Keith Owens wrote:
Hi,

> I repeat: It does not verify using stock gnupg 1.0.3, with or without
> rsaref. I tried 1.0.3 without load-extension rsaref and it still
> failed to verify.

1.0.3 does not use rsaref or any other rsa module - it is silently
ignored. I have no way to test 1.0.2 with the rsaref module - my
test with the rsa moules says that the signature is bad. pgp 2.6.3a
(From Debian) says the same.

Interesting new class wu-ftp bug ;)

Ciao,

Werner


--
Werner Koch GnuPG key: 621CC013
OpenIT GmbH http://www.OpenIT.de

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org

On Mon, 2 Oct 2000 11:53:01 +0200,
Werner Koch <wk@gnupg.org> wrote:
>1.0.3 does not use rsaref or any other rsa module - it is silently
>ignored. I have no way to test 1.0.2 with the rsaref module - my
>test with the rsa moules says that the signature is bad. pgp 2.6.3a
>(From Debian) says the same.
>
>Interesting new class wu-ftp bug ;)

gpg 1.0.2 with rsaref module accepts the signature. PGP version
unix50i1b accepts the signature. pgp-2.6.3i does not. gnupg 1.0.3
does not. A worrying set of results, especially since an earlier
version of gpg worked.

# pgpv wu-ftpd-2.6.1.tar.gz.asc
This signature applies to another message
File to check signature against [wu-ftpd-2.6.1.tar.gz]:
Good signature made 2000-07-02 05:18 GMT by key:
1024 bits, Key ID 62885875, Created 1999-05-22
"WU-FTPD Development Group <wuftpd-members@wu-ftpd.org>"

WARNING: The signing key is not trusted to belong to:
WU-FTPD Development Group <wuftpd-members@wu-ftpd.org>

# pgp-2.6.3i wu-ftpd-2.6.1.tar.gz.asc
Pretty Good Privacy(tm) 2.6.3i - Public-key encryption for the masses.
(c) 1990-96 Philip Zimmermann, Phil's Pretty Good Software. 1996-01-18
International version - not for use in the USA. Does not use RSAREF.
Current time: 2000/10/02 10:26 GMT

File has signature. Public key is required to check signature.

File 'wu-ftpd-2..$00' has signature, but with no text.
Please enter filename of material that signature applies to: wu-ftpd-2.6.1.tar.gz
.
WARNING: Bad signature, doesn't match file contents!

Bad signature from user "WU-FTPD Development Group <wuftpd-members@wu-ftpd.org>".
Signature made 2000/07/02 05:19 GMT using 1024-bit key, key ID 62885875

WARNING: Because this public key is not certified with a trusted
signature, it is not known with high confidence that this public key
actually belongs to: "WU-FTPD Development Group <wuftpd-members@wu-ftpd.org>".

Signature and text are separate. No output file produced.

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org

On Mon, 2 Oct 2000, Keith Owens wrote:

> gpg 1.0.2 with rsaref module accepts the signature. PGP version
> unix50i1b accepts the signature. pgp-2.6.3i does not. gnupg 1.0.3

I still wonder why gpg-1.0.2 with rsa.c does not accept the sig.

The strange thing I noticed about this signature is:

:signature packet: algo 1, keyid 0ECD082462885875
version 3, created 962515123, md5len 5, sigclass 01
^^
that it uses textmode which is somewhat strange for a detached
signatures. textmode does not has the data asis but translates LF
to CR,LF and strips white spaces - there is no reason to use it for
binary files. There are a couple of workarounds in GnuPG to cope
with all the different behaviour of the different PGP flavours
regarding the textmode.

Ciao,

Werner


--
Werner Koch GnuPG key: 621CC013
OpenIT GmbH http://www.OpenIT.de

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org