[imp] Bad gpg signatures - solved

[Chris Hastie]

On Wed, 12 Mar 2003, Rick Emery <rick at emery.homelinux.net> wrote
>Quoting Michael M Slusarz <slusarz at bigworm.colorado.edu>:
>
>> Yup, that would do it.  When signing a message, you must sign the message by
>> analyzing the canonical contents of the message.  The canonical contents may
>> NOT be the same as what is actually sent, not to mention that anything added
>> to the message will invalidate the signature.
>
>I thought that made sense, but then I had another thought. How do mailing lists
>do it? At the bottom of this message, MailMan will attach a signature 
>similar to
>this:
>
>--
>IMP mailing list
>Frequently Asked Questions: http://horde.org/faq/
>To unsubscribe, mail: imp-unsubscribe at lists.horde.org
>
>All of the other horde lists attach a similar signature, yet messages sent to
>the lists show a good pgp signature. Presumably, MailScanner is doing the same
>kind of thing: attaching a text message to the end of...
>
>Wait a second; a light bulb just went on. Most of the messages I see have the
>mailing list signature in-line, but I think I have seen some messages that have
>it as a seperate message part. Is it possible that the mailing list software is
>actually _attaching_ the [mailing list] signature to the pgp-signed message and
>it gets displayed in-line, where MailScanner is actually putting the signature
>_in_ the message (hence changing the message contents and invalidating the pgp
>signature)?
>

It depends to some extent on how the original message was constructed. 
If the GPG signed message is sent as plain text with the signature 
included in that, then the section of the message that is signed is 
indicated.

eg (hope the # is enough to escape this!)

# ----BEGIN PGP SIGNED MESSAGE-----
# Some text
# ----BEGIN PGP SIGNATURE-----
# Signature
# ----END PGP SIGNATURE-----

adding plain text to the end of this will not corrupt the signature.

If PGP-MIME is used, then it is possible to 'attach' a separate MIME 
part at the end of the message. This will not corrupt the signature. 
BUT, if Mail Scanner attempts to add the text onto the end of an 
existing MIME part you probably have a problem.

The complication is that some (particularly M$ based) systems do just 
that - presumably because some (particularly M$ manufactured) MUAs have 
considerably difficulty with more complex MIME structures. For example, 
try sending a multipart/mixed message containing three parts:

i   text/plain
ii  image/gif
iii text/plain

to Outlook 97. Hardly a massively complex message, but only part i) will 
be displayed. Part iii will appear as an attachment, probably with a 
file extension of .dat (not the obvious .txt) making it bloody difficult 
to read.
-- 
Chris Hastie