Re: PGP signature of empty string

Am 04.03.2013 um 10:01 schrieb Peter Gutmann <[email protected]>:

> Florian Mutter <[email protected]> writes:
> 
>> I have a problem with signing and checking a detached pgp signature of an
>> empty string.
> 
> Hmm, why are you trying to sign an empty message?  Forgery of such a signature
> on a message is trivial, you can transfer the signature to any other empty
> message and it'll still verify.

I'm trying to implement XEP-0027 (http://xmpp.org/extensions/xep-0027.html), OpenPGP in XMPP.  From this document:

"The text that is signed MAY be the empty string. When signing presence, the sender SHOULD sign the XML character data of the <status> element."

And that <status> element can be empty.

> 
>> After some debugging I think this error comes from contextMessageFunction().
>> When this is called from cryptEncrypt (to generate the hash) it set's the
>> flag: CONTEXT_FLAG_HASH_DONE (line  544 of cryptctx.c) for zero length data.
>> When cryptGetAttribute( CRYPT_ENVINFO_SIGNATURE_RESULT) is called the flag is
>> checked and no hash comparison is performed at all. Maybe the check for
>> already hashed data in line 524 needs to check for that second flag
>> CONTEXT_FLAG_HASH_INITED and if that is set not stopping processing.
>> 
>> I tested it without stopping there but then when the hashes are compared
>> (compareDataConstTime()), they only match up to 16 Bytes and the rest of the
>> 35 Bytes does not match. I'm not sure if this is any helpful information. The
>> hashes are SHA1. One generated by cryptlib and one by gpg for the empy string.
>> gpg can verify the signature for the empty string.
> 
> Can you send me a signed file of this type, along with the code that you're
> using to exercise the problem?  I'm not even sure how you'd create an empty
> signed message with GPG, do you just sign a zero-length file?

I attached a zip with my test program and test files. To create such a signature call:

gpg --default-key [email protected] --detach-sign - > emptySignature.gpg

and enter EOF (Crtl-d). This creates a signature of the empty string. Since I did not find a way to extract the SHA1 hash from that signature I'm not 100% sure gpg signes the empty string or something else.

> 
>> BTW: The sample code in the manual on page 92/93 to verify detached pgp
>> signatures is missing the attribute CRYPT_ENVINFO_DETACHEDSIGNATURE set to 1
>> and also in cryptPushData the signature should be pushed not the data.
> 
> Thanks, it'll be fixed in the next update.
> 
> Peter.
>

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.