Subject: Question

From: Taral <[email-masked]>
Date: Thu, 22 Mar 2001 17:26:47 -0600

[ Please Cc: me on messages, I am not on this list ]

I'm sure this has been asked before, but I'm going to ask it, because I
have yet to locate a sufficient answer.

In the current PGP/MIME standard, it is specifically stated that
signatures are calculated after the application of the CTE. However,
RFC 2045 makes it clear that MTAs may re-encode bodies as necessary. The
way signatures are currently calculated, this operation (which is
perfectly valid under MIME) invalidates the signature. Can anyone
explain why this would be a desirable situation?

-- 
Taral <[email-masked]>
Please use PGP/GPG to send me mail.
"Never ascribe to malice what can as easily be put down to stupidity."

---

From: Derek Atkins <[email-masked]>
Date: 22 Mar 2001 22:59:16 -0500

The multipart/security RFC (please excuse me for not spewing the
number) specifically forbids MIME agents from re-calcuating the
_INTERNAL_ CTE of a message.  You may change the CTE of a message for
transport, but you must revert to the original CTE before security
decapsulation.

In other words, sendmail may apply a radix64 to the message provided
that the receiving sendmail reverts the radix64 back to the original
form.  In other other words, multipart/security forbids the use of
this MIME feature.

-derek

Taral <[email-masked]> writes:

> --tKW2IUtsqtDRztdT
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> Content-Transfer-Encoding: quoted-printable
> 
> --=20
> --tKW2IUtsqtDRztdT
> Content-Type: application/pgp-signature
> Content-Disposition: inline
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.4 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> 
> iEYEARECAAYFAjq6ijcACgkQ7rh4CE+nYEkQ/gCeJMAPsXtQ5/j6LMxpEoEk9HWN
> BPsAoPLXQ1VMF8SC6WrmZU6kS5nbEMjX
> =snc9
> -----END PGP SIGNATURE-----
> 
> --tKW2IUtsqtDRztdT--

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Derek Atkins <[email-masked]>
Date: 23 Mar 2001 00:26:08 -0500

And this is one way in which MIME was broken to begin with, because
it didn't play nice with security.  With security multiparts, you
MUST NOT change the message in transit.  If you want to change it,
you must super-encode it, so that in the end you can return to the
original bit-stream of the original message.

-derek

Taral <[email-masked]> writes:

> --/9DWx/yDrRhgMJTb
> On Thu, Mar 22, 2001 at 10:59:16PM -0500, Derek Atkins wrote:
> >=20
> This seems awfully strange. The whole point of MIME is to be able to
> be permissive in these kinds of things. Having read the MIME standards a
> few times, I would never have assumed that a multipart type would ever
> have special restrictions like this based on subtype. In fact,
> multipart/signed is not required to be implemented by agents, and they
> are _explicitly_ permitted to treated like multipart/mixed, in which the
> CTE can be changed if recoding is needed.
> 
> --=20
> Taral <[email-masked]>
> --/9DWx/yDrRhgMJTb
> iEYEARECAAYFAjq63dwACgkQ7rh4CE+nYElQrQCfat5GtKE0EzfT922bouIMunPi
> xEkAn3BOVqwFU8scRR6OVDwV7ZVqAEI9
> =0YMf
> --/9DWx/yDrRhgMJTb--

---

From: Taral <[email-masked]>
Date: Thu, 22 Mar 2001 23:23:40 -0600