Re: Broken display of clearsigned PGP message

[Reiner Steib <reinersteib+gmane@imap.cc>]

On Fri, Oct 13 2006, Andreas Seltenreich wrote:

>> I'm not sure if this message is legal according to RFC 2440.  In 6.2
>> it states that Armor Headers are followed by a blank line, which is
>> defined as "zero-length, or containing only whitespace", however in
>> 7. it uses the term "empty line" when describing Armor Headers in
>> cleartext signatures.
>>
>> IMHO we should follow "be liberal in what you accept" here, especially
>> since GnuPG considers the message legal.  Should I apply the attached
>> patch to v5-10 and HEAD?  Can anyone imagine regressions?
>
> I just realized that with the current behavior, an attacker could
> completely replace the text within Gnus' signed-message markup with
> his own message without interfering with the verification process.  So
> I guess it is hard to make the situation worse...  Will commit the
> patch.

Thanks.

I'd suggest to add a rather detailed explanation about this problem
and the relevant RFC in `mm-uu-pgp-signed-extract-1'.

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/