Re: Once again: PGnus & PGP

[Carey Evans <c.evans@clear.net.nz>]

Jack Twilley <jmt+usenet@nycap.rr.com> writes:

> >>>>> "Carey" == Carey Evans <c.evans@clear.net.nz> writes:
> 
>     Jack> Now what about this PGP/MIME crap?  Is this the message with
>     Jack> detached signature thing?
> 
>     Carey> Yes.  It seems to be generated by mutt, and maybe be TM.
>     Carey> Hopefully I've managed to sign this message using it.
> 
> While you may have signed it, no amount of abuse of your message
> caused PGP to successfully verify your signature.  Have you ever
> successfully verified a signature of a PGP/MIME message?

Mutt successfully verifies my message, as well as others on the
debian-devel mailing list, where PGP/MIME is used by a few people.

To verify the signature manually:

  Save the PGP signature in the application/pgp-signature part, as
  "msg.txt.sig" for example.

  Save the headers and content of the text/plain part, leaving it in
  its MIME encoding, e.g. as "msg.txt".

  Run PGP against the signature, e.g. as "pgp msg.txt.sig".

The process is described in RFC 2015.  By "leaving it in its MIME
encoding, I mean that the first line in the file is the "Content-Type"
header, and my .sig separator "-- " is still QP-encoded as "--=20".

I'm not claiming that PGP/MIME is actually any good, but this is how I
can get a good signature from my message.

-- 
	 Carey Evans  http://home.clear.net.nz/pages/c.evans/

"Try explaining a syn-ack-fin-rst scan to a dialup provider abuse drone. You
can almost hear the belt slip off the brain drive shaft."   - Strange in asr