Re: PGP signature of empty string

On 03/12/2013 09:46 PM, Peter Gutmann wrote:
> It doesn't get it wrong, it just allows an operation that doesn't make any
> sense.

i agree that signing the empty string isn't a sensible operation

>> What if I want to sign an empty email (can this happen anyway?)?
> 
> Since you'll always get the same results, just use GPG to sign an empty string
> and keep a copy of the resulting block of bytes.  Then whenever you need a
> signed empty string, memcpy() it to the output.

I don't think Peter's suggestion above is correct; an OpenPGP signature
includes a chunk of metadata (including e.g. the timestamp of the
signature) that will vary over time, even if the content of the main
body of the message stays the same.  (and this metadata is also included
in the digested material being signed)  So this technically isn't an
equivalent response.

However, i think peter's original suggestion of "don't do that" is still
probably the right way to go.

	--dkg

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Icedove - http://www.enigmail.net/

iQJ8BAEBCgBmBQJRP+FEXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB
NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpc9VQQAJxwYhDBsUeCa6byzAfJVdWb
8yUV5hAyk5vTkSG0l2fth2FlvzpDKIDLvZhT+LMaXGYwxcjhZAEHp7ZhPPhQWwF9
tj4WlNuFSkrPam8AdrIASnpSa9t9xePB1D1c8I3noHorDSCb4/h53JQ9tGxlPdIc
s2VnvJorv059XS6v2v+ybv58PDFNtHPJ5HRw6pyUW4TAMgnJsriiAwH98eR3E+rW
huWDcytO+GRrJjfkGtqx8T1j5YCIPwhD28K/ENveNswkfHp/JZr3nMAfWBDe+6UO
zxXfkW5BpqEjhALK4eYt8BXDUTRj0yL1CHz8Z1VdvjsiQ6q9xiARajavcx88981f
AjT1sbRak3B8N+WeRLlZun6iwwXv95manCwGsGVlbsw8rPkV5SnXxnj64tnJVdIC
zpHPH2VqoQOMOH6vjekU1mKILGIf3yh+9hgYTmGDLvddJsg2/6hGis/R3UZSNciE
DT/tRxfepQBUnnXFhwiix8PHlfRcFLjnDliuHkTRPRPNdOUe6OYvgdrdWuyh6CcP
iTAmbA4NYKtLyyjeFRScwZNWmbmYFZTTTYeUFqYnjFZpW5e26qlMGPD4HtnovPW4
3o2ApJW7dkrPb41UfRhMGS9eGtUs/JEUTxwS+mTBXlJsa+YK4/QV3sJkg7SQHY6r
1qFwAxBezRkthSs/5e79
=MNg2
-----END PGP SIGNATURE-----