Re: MML, message-send-hook and automatically GnuPG-signing messages.

[Florian Weimer <fw@s.netic.de>]

Jonas Steverud <d4jonas@dtek.chalmers.se> writes:

> If I understand it correctly this would work:
> In message-send-hook having a function adding
> <#encrypted>/<#/encrypted> (or whatever) around the entire text and
> then having a buffer that looks like:
> 
> ----------8<--------
> -----texts follows...----
> <#encrypted>
> Some text...
> <#attachment ...>
> ...more text.
> -- 
> .sig
> <#/encrypted>
> ----------8<--------

Yes, that's the idea.  You probably want to add extra information to the
`<#encrypted>' tag, for example the recpients' key ID.

> I will dig into it later when I have a Gnus that works with
> mml-blah-alist.

Glad you found it.  I guess the variable is only defined if `mml' has
been loaded, which happens automatically when you compose a message
(and not upon Gnus startup).

> > I don't think an additional hook is required, in fact, I would be
> > surprised. ;)
> 
> See other mail, I found message-send-*-hook. I blame the manual.

`message-send-*-hook' won't work, that's too late.  You have to bind
`mm-use-ultra-safe-encoding' to `t' while encoding the parts over which
the signature is to be calculated (this prohibits 8-bit data and other
nasty things, as mandated by RFC 2015).

> > You only need additional data structures for decrypting and verifying
> > signatures.
> 
> You forgot the `"' around the word "only"... ;-)

Well, I should have put it before `for'. ;)

> I spoke with the people in se.dator.sys.unix (swedish *nix group) and
> the conclusion was that although it was not 100% safe one could fairly
> sure that it was safe enough to use on Linux/Solaris. 

Linux and Solaris are completely different in this regard. Solaris
(at least the version I tested) is safe, while Linux isn't.

> There where possibilities to intercept my passphrase but the work
> and luck that was needed was too great. You needed to be root to
> begin with (which is a bit hard on a well administred system).

In fact, this is not necessary, and that's the problem. :(