Subject: Re: pointers to openpgp-interop knowledge base?

From: [email-masked] (Peter Gutmann)
Date: Mon, 5 Nov 2001 03:22:41 +1300 (NZDT)

John J Kane <[email-masked]> wrote:
>Are there any sources online for the following?
>
>  * contact info for people involved in interop testing
>  * examples of non-conformant output (for testing)
>  * examples of conformant output which have been documented to break certain
>    implementations

I've found that just using the various options of PGP 5.0 (which is not-quite-
OpenPGP), 6.5.x, and GPG will give you all the quirks and peculiarities you
need.  Once you've made sure you can read what they produce, you should also
check that they can read what you produce.

Peter.

---

From: "vedaal" <[email-masked]>
Date: Sun, 4 Nov 2001 12:07:00 -0500

- ----- Original Message ----- 
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Sunday, November 04, 2001 9:22 AM
Subject: Re: pointers to openpgp-interop knowledge base?

> I've found that just using the various options of PGP 5.0 (which is
> not-quite- OpenPGP), 6.5.x, and GPG will give you all the quirks and
> peculiarities you need.  Once you've made sure you can read what they
> produce, you should also check that they can read what you produce.
> 
> Peter.

short summary of intercompatibility, and incompatibilities:

messages from any pgp version can be read and verified by gpg {with the
idea plugin},
except if a shared key/split key system is used
[gpg can encrypt to a split key, but not sign or decrypt with a shared key
system]

messages from gpg using the throw-key id switch, cannot be read by 'any'
version
of pgp {except for Disastry's 2.6.3i multi 5}

messages from gpg using mdc, cannot be read by any pgp version prior to
7.xx
{6.5.8ckt is an exception, having a patch to ignore the mdc packets}

messages from 7.xx using twofish or aes, cannot be decrypted by pgp
versions prior
to 7.xx, but signatures can be verified
{again, 6.5.8ckt is an exception}

messages using an RSA v4 key, can be decrypted, and can be verified, by pgp
versions
prior to 7.xx, but, for some reason, not, if the message is 'both' signed
and encrypted

messages signed with ripemd-160 or sha-1, can be verified by all pgp
versions greater
than 2.6.x, even if they do not use them to sign with for a particular key
type

hope this is useful,

please correct if there are any mistakes or oversights,

thanks,

vedaal

---

From: Len Sassaman <[email-masked]>
Date: Sun, 4 Nov 2001 12:29:25 -0800 (PST)

> please correct if there are any mistakes or oversights,

Well, you've left out GnuPG versions. GnuPG hasn't always been able to
handle everything you mention.

GnuPG of any version produces messages signed with v3 keys encrypted in v3
format that PGP cannot decrypt.

In the implementation nits, it is noted that PGP 5.x cannot verify v4 sigs
on non-v4 material. Actually, 6.x cannot either, but 7.x and greater can.

Then there's the ElGamal signing-keys that GnuPG generates. I don't know
what else supports them.

Also, signing subkeys are probably a problem with a lot of other
implementations as well.

We have no idea what Hushmail's interop status is, since there appears to
be no way to either get access to Hushmail users' public keys in order to
verify their signatures, or import non-Hushmail users' keys into the
Hushmail system to encrypt to them.

...etc.

I could keep throwing things off the top of my head -- but shouldn't we
have some formal system for listing all of this?

--

Len Sassaman

Security Architect            |  "Now it's all change --
Technology Consultant         |   It's got to change more."
                              |
http://sion.quickie.net       |              --Joe Jackson

---

From: John W Noerenberg II <[email-masked]>
Date: Mon, 5 Nov 2001 12:45:33 -0800

>have some formal system for listing all of this?

Yes.

Both Brian Smith and John Kane have volunteered to maintain the 
information.  I've asked them to collaborate on maintaining the 
pages.  My preference is we set something up under openpgp.org site. 
openpgp.org is a computer at Phil Zimmermann's house.  There's other 
stuff I would like to see there, but interoperability info would be a 
Real Good Thing to get 2440 to DRAFT.

I have a program to contribute which will read openpgp files and 
report on their structure.  John Callas wrote the original version, 
and I've been updating it for 2440.  It's not a complete 
implementation of 2440.  But it locates packet boundaries, identifies 
packet types, and describes the plaintext portions of packets.

If people send me files, I'll run them through my parser, and tell 
you what happens.  The program runs on my Mac, but should be 
reasonably portable to other systems.  I'll publish it on 
openpgp.org, as soon as we make a suitable place.  I've heard tell of 
similar programs, but I don't have particular knowledge of any.
-- 

john noerenberg
[email-masked]
   ----------------------------------------------------------------------
   While the belief we  have found the Answer can separate us
   and make us forget our humanity, it is the seeking that continues
   to bring us together, the makes and keeps us human.
   -- Daniel J. Boorstin, "The Seekers", 1998
   ----------------------------------------------------------------------

---

From: Kazu Yamamoto (山本和彦) <[email-masked]>
Date: Tue, 06 Nov 2001 13:24:24 +0900 (JST)

From: John W Noerenberg II <[email-masked]>
Subject: Re: pointers to openpgp-interop knowledge base?

> packet types, and describes the plaintext portions of packets.

Another PGP parser can be found:
	http://pgp.iijlab.net/pgpdump.html

Web interface is also available.

--Kazu

---

From: "vedaal" <[email-masked]>
Date: Tue, 6 Nov 2001 14:33:41 -0500

----- Original Message -----
From: "Kazu Yamamoto (????)" <[email-masked]>
To: <[email-masked]>
Sent: Monday, November 05, 2001 11:24 PM
Subject: Re: pointers to openpgp-interop knowledge base?

> Web interface is also available.

have tried the web interface, with a peculiar result:

encrypted a message to an rsa key using gpg with the preference set to
twofish,

decrypting with gpg showed algorithm 10, as expected.

using the pgp dump web interface,  it identified the message as using mdc
packets, [also as expected], but listed the algorithm as 1  {a 'default '
listing for 'idea' once an  rsa key is identified, even though 'idea' was
not used?}

is this just the web interface, or does the parser do this too?

vedaal

---

From: Len Sassaman <[email-masked]>
Date: Tue, 6 Nov 2001 12:19:45 -0800 (PST)

On Mon, 5 Nov 2001, John  W Noerenberg II wrote:

> I've heard tell of similar programs, but I don't have particular
> knowledge of any. --

GnuPG has such a parser built into it. Also, there's a perl script written
by Mark E. Shoulson called pgpacket3.1 that tries to do the same thing.

---

From: Kazu Yamamoto (山本和彦) <[email-masked]>
Date: Wed, 07 Nov 2001 10:43:58 +0900 (JST)

From: "vedaal" <[email-masked]>
Subject: Re: pointers to openpgp-interop knowledge base?

> listing for 'idea' once an  rsa key is identified, even though 'idea' was

Please send such a report directly to me, not to the entire list.

Please send me a sample packet which causes your problem. I will fix it if
it's a bug.

--Kazu

---

From: "Michael Young" <[email-masked]>
Date: Tue, 6 Nov 2001 23:17:56 -0500

-----BEGIN PGP SIGNED MESSAGE-----

> listing for 'idea' once an  rsa key is identified, even though 'idea' was

The algorithm identifier lives in material encrypted under the public key.
Without the private key, all the parser could do is guess.  (Does this
parser have the ability to decrypt the contents even if the unprotected
private key were present?)

The MDC packet itself is encrypted under the session key.  Again, the
parser wouldn't be able to verify it.  When you say it "identified the
message
as using mdc packets", I presume you mean that it noted that a
"symmetrically encrypted integrity protected data packet" (tag 18)
was present at the beginning, not that there was a valid MDC packet, right?

On that note, I've asked a couple of times about the way GnuPG
generates these packets, but I have never seen an authoritative
answer.  The issue was that GnuPG used an old-style indeterminate-length
packet for the plaintext before the MDC (see my message of August 23
and any followup discussion for details).  Should this be legal?

---

From: Werner Koch <[email-masked]>
Date: Wed, 07 Nov 2001 09:10:39 +0100

> packet for the plaintext before the MDC (see my message of August 23

But only if the plaintext is a compressed packet - right?

  Werner

-- 
Werner Koch        Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH      et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions                                        -- Augustinus

---

From: David Shaw <[email-masked]>
Date: Wed, 7 Nov 2001 10:50:17 -0500

> by Mark E. Shoulson called pgpacket3.1 that tries to do the same thing.

The new (currently in test) GnuPG also comes with "gpgsplit" which
breaks OpenPGP messages into their constituent packets.  It's quite
handy for comparing the output of two different programs.

David

-- 
David Shaw          |  Technical Lead
<[email-masked]>  |  Enterprise Content Delivery
617-250-3028        |  Akamai Technologies

---

From: "vedaal" <[email-masked]>
Date: Wed, 7 Nov 2001 13:09:37 -0500

----- Original Message -----
From: "Werner Koch" <[email-masked]>
To: "Michael Young" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, November 07, 2001 3:10 AM
Subject: Re: Parser abilities, and MDCs (Re: pointers to openpgp-interop
knowledge base?)

----- Original Message -----
From: "Werner Koch" <[email-masked]>
To: "Michael Young" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, November 07, 2001 3:10 AM
Subject: Re: Parser abilities, and MDCs (Re: pointers to openpgp-interop
knowledge base?)

> But only if the plaintext is a compressed packet - right?

here is the url for the pgpdump web interface:
http://xdv.org/pgpdump/

here is the output for a message encrypted to an rsa key using gpg with
twofish as the algorithm:

PGPdump Results
Old: Public-Key Encrypted Session Key Packet(tag 1)(268 bytes)
New version(3) Key ID - f1 56 64 88 f7 7a ff 7b
Pub alg - RSA Encrypt or Sign(pub 1) RSA m^e mod n(2047 bits) -
78 02 54 44 fd 0b ec 0d 44 de 38 f8 95 f4 8d 89 0a 92 4a 47 4e f8 84 55 38
47 24 1a 3e 91 36 9f 72 32 21 54 43
f5 8b 4f be 1d ce 4c ec ac 87 89 85 f0 ae 2c a7 48 c8 e0 31 aa 42 88 68 41
51 56 84 6b bc 0a a1 9d 50 9b f8 7b 35 96 82 d7 9b 77 e6 95 b1 83 77 13 f2
bb c1 0b 28 9a e8 f9 ac 09 10 8d 93 84 92 5b 95 8c 7a a9 43 44 6d 38 a7 40
46 ef a6 86 2c bc 1c ae 2b 27 0d 48 34 d9 c3 89 d3 7b ef a9 b3 b7 dd 9d 87
80 30 26 8f b1 0d a6 a7 ba d0 aa 6c 3e 76 6d 82 ac 72 88 14 eb 90 8f 8e b8
29 bf ed 5a 07 46 93 02 ae 0e d4 46 3f df 6d 29 6b 70 70 a6 20 8a 95 83 4c
dc 7e 69 e9 69 56 a1 a6 8d fd ab 79 38 1d 93 da b8 1f d1 78 84 84 7b 48 74
d8 66 94 64 5d 8a 88 61 fb 14 de ba 4e 33 1c 6f ba 84 70 02 28 11 4f 05 ba
7d 4f 2e c6 f4 92 7a 99 cc 5d e6 98 e3 4f 24 7c df f9 57
-> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02
New: Symmetrically Encrypted and MDC Packet(tag 18)(70 bytes)
Ver 1 Encrypted data (plain text + MDC SHA1(20 bytes))

PGPdump Interface, Copyright (c) 2001, Stefan H. Holek, [email-masked]

is there any additional mdc information necessary/desirable to be displayed?

vedaal

---

From: John W Noerenberg II <[email-masked]>
Date: Thu, 8 Nov 2001 11:58:41 -0800

At 1:24 PM +0900 11/6/01, Kazu Yamamoto 
>Web interface is also available.

Thanks, Kazu.  I'll have a look.

>by Mark E. Shoulson called pgpacket3.1 that tries to do the same thing.

It will be interesting to compare the different parsers.  I suspect 
each will have their uses.
-- 

john noerenberg
[email-masked]