oddies with enigmail

oddies with enigmail

[Uwe Brauer]

Hello 

The following is odd, I send a mail to myself, sign and encrypted,
using gnus and the mml backend for gpg, I then read
read the mail via mozilla/enigamail and after typing my passphrase the
message is decrypted and the signtaure is verified.

However when I only sign a message the same way and try to verify 
I obtain the following:



OpenPGP Security Info

Unverified signature

gpg command line and output:
/usr/bin/gpg --charset utf8 --batch --no-tty --status-fd 2 --verify
gpg: NOTE: old default options file `/home/oub/.gnupg/options' ignored
gpg: Signature made Thu Jul  7 19:14:29 2005 UTC using RSA key ID 93B61FDD
gpg: WARNING: signature digest conflict in message
gpg: Can't check signature: general error

Can anybody tell me what is up there, or shall I ask in the gpg
mailing list.

Thanks

Uwe Brauer 

Re: oddies with enigmail

[Werner Koch]

On Thu, 07 Jul 2005 19:16:10 +0000, Uwe Brauer said:

> gpg: NOTE: old default options file `/home/oub/.gnupg/options' ignored

[ You should move all your options from that file to gpg.conf -
  options has been deprecated a long time ago]

> gpg: Signature made Thu Jul  7 19:14:29 2005 UTC using RSA key ID 93B61FDD
> gpg: WARNING: signature digest conflict in message

The message looks like

  -----BEGIN ...
  Hash: MD5

  ....
  -----BEGIN ..
  base64/encoded/block

and the actual signature in the base64 block indicates that another
hash algorithm has been used (e.g. SHA-1).  This may also happen if
the Hash: header is missing completely because it defaults to MD5.

It is for sure an Enigmail problem.  I guess for some reasons it
mangles or deletes the Hash: header.

When signing and encrypting a different format than the above clear
signed format is beeing used and thus the problem does not occur.


Shalom-Salam,

   Werner

Re: oddies with enigmail

[Uwe Brauer]

>>>>> "Werner" == Werner Koch <wk@gnupg.org> writes:

    Werner> On Thu, 07 Jul 2005 19:16:10 +0000, Uwe Brauer said:
    >> gpg: NOTE:  old default options file `/home/oub/.gnupg/options'
    >> ignored

    Werner> [  You  should move all  your  options from that  file  to
    Werner> gpg.conf -
    Werner>   options has been deprecated a long time ago]

Thanks I did not know this.


    Werner>   ....
    Werner>   -----BEGIN ..
    Werner>   base64/encoded/block

    Werner> and the  actual  signature in  the base64 block  indicates
    Werner> that  another hash algorithm has  been  used (e.g. SHA-1).
    Werner> This  may also   happen  if the  Hash:  header is  missing
    Werner> completely because it defaults to MD5.

    Werner> It is for sure an Enigmail problem.  I guess for some reasons it
    Werner> mangles or deletes the Hash: header.

    Werner> When signing and encrypting   a different format than  the
    Werner>   above clear signed format   is beeing used  and thus the
    Werner> problem does not occur.

The question is can I clear sign the message such that enigmail would
not complain?

Uwe 

Re: oddies with enigmail

[Werner Koch]

On Wed, 13 Jul 2005 18:29:03 +0000, Uwe Brauer said:

> The question is can I clear sign the message such that enigmail would
> not complain?

Do you say that pgg inserts the Hash line?  This is obviously wrong -
it is best to let gpg create the cleas signed message.  This will make
sure that the correct header is used.


Salam-Shalom,

   Werner

Re: oddies with enigmail

[Simon Josefsson]

Werner Koch <wk@gnupg.org> writes:

> On Wed, 13 Jul 2005 18:29:03 +0000, Uwe Brauer said:
>
>> The question is can I clear sign the message such that enigmail would
>> not complain?
>
> Do you say that pgg inserts the Hash line?  This is obviously wrong -
> it is best to let gpg create the cleas signed message.  This will make
> sure that the correct header is used.

PGG doesn't insert nor remove any Hash: lines.  The output from gpg is
used directly, except for QP encoding when needed.  Gnus will QP
encode the output from gpg, so the receiver till have to perform QP
decode before it looks like a valid OpenPGP packet.  This might break
some MUAs that expect the OpenPGP armor to not be QP escaped, but
rather, only the signed data.  But such a message wouldn't conform to
MIME specs (the '=' in the CRC24 tag is invalid QP unless escaped),
and some MTAs bounce those messages...

That the morale is to use PGP/MIME instead is hopefully obvious.

Re: oddies with enigmail

[Uwe Brauer]

>>>>> "Simon" == Simon Josefsson <jas@extundo.com> writes:

    Simon> Werner Koch <wk@gnupg.org> writes:
    >> On Wed, 13 Jul 2005 18:29:03 +0000, Uwe Brauer said:
    >> 
    >>>  The   question is can I  clear   sign the  message  such that
    >>> enigmail would not complain?
    >> 
    >> Do you say  that pgg inserts the Hash  line?  This is obviously
    >> wrong - it is best to let gpg  create the cleas signed message.
    >> This will make sure that the correct header is used.

    Simon> PGG doesn't insert nor remove any  Hash: lines.  The output
    Simon>  from gpg  is used directly,  except  for QP encoding  when
    Simon> needed.   Gnus will QP encode  the output from gpg,  so the
    Simon> receiver  till  have to perform  QP decode  before it looks
    Simon> like  a valid OpenPGP packet.  This  might  break some MUAs
    Simon> that expect  the OpenPGP armor   to not be QP escaped,  but
    Simon> rather, only the signed data.   But such a message wouldn't
    Simon> conform to MIME specs (the '='  in the CRC24 tag is invalid
    Simon> QP unless escaped), and some MTAs bounce those messages...

    Simon> That the morale is to use PGP/MIME instead is hopefully obvious.

Well that is what I used
mml-secure-message-sign-pgpmime

Re: oddies with enigmail

[Simon Josefsson]

Uwe Brauer <oub@mat.ucm.es> writes:

>>>>>> "Simon" == Simon Josefsson <jas@extundo.com> writes:
>
>     Simon> Werner Koch <wk@gnupg.org> writes:
>     >> On Wed, 13 Jul 2005 18:29:03 +0000, Uwe Brauer said:
>     >> 
>     >>>  The   question is can I  clear   sign the  message  such that
>     >>> enigmail would not complain?
>     >> 
>     >> Do you say  that pgg inserts the Hash  line?  This is obviously
>     >> wrong - it is best to let gpg  create the cleas signed message.
>     >> This will make sure that the correct header is used.
>
>     Simon> PGG doesn't insert nor remove any  Hash: lines.  The output
>     Simon>  from gpg  is used directly,  except  for QP encoding  when
>     Simon> needed.   Gnus will QP encode  the output from gpg,  so the
>     Simon> receiver  till  have to perform  QP decode  before it looks
>     Simon> like  a valid OpenPGP packet.  This  might  break some MUAs
>     Simon> that expect  the OpenPGP armor   to not be QP escaped,  but
>     Simon> rather, only the signed data.   But such a message wouldn't
>     Simon> conform to MIME specs (the '='  in the CRC24 tag is invalid
>     Simon> QP unless escaped), and some MTAs bounce those messages...
>
>     Simon> That the morale is to use PGP/MIME instead is hopefully obvious.
>
> Well that is what I used
> mml-secure-message-sign-pgpmime

Oh.  Ok.  Still, PGG shouldn't alter any Hash: headers.  Was that
definitely the problem here?  Perhaps something else is somehow
modifying that header.