Re: PGP signature of empty string

Florian Mutter <[email protected]> writes:

>I'm trying to implement XEP-0027 (http://xmpp.org/extensions/xep-0027.html),
>OpenPGP in XMPP.  From this document:
>
>"The text that is signed MAY be the empty string. When signing presence, the
>sender SHOULD sign the XML character data of the <status> element."
>
>And that <status> element can be empty.

Eek!

>I attached a zip with my test program and test files. 

Thanks!  So verifying the signature is easy, just change the code to:

  if( strlen(text) > 0 )    
    cryptEncrypt( hashContext, (void *)text, (int)strlen(text) );

Since calling cryptEncrypt() on a hash context with length == 0 wraps up the
hashing, and since you're not hashing anything anyway, you can just skip the
call if the hashed data length is zero.

To verify the signature, you should be able to do something similar.

However:

  No one uses XEP-0027 these days, they all use OTR. The PGP integration with
  XMPP clients was an early experiment in the Jabber community before we even
  called it XMPP. Think 13+ years ago. But clients never signed empty strings,
  although we never fixed the spec because no one was using the technology.
  I'll push to make the spec Obsolete.

Peter.

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.