🚀 go-pugleaf

Thus said bontchev@fbihh.informatik.uni-hamburg.de:
>It is my understanding that RIPEM, in its MIC-CLEAR mode copies some
>of the headers of the message inside the area that is signed, in order
>to prevent palyback attacks. Right now I am hacking a perl script to
>integrate PGP with my e-mail/news software and would like to include
>the same feature.
>
>So my question is: which header lines are copied? Obviously, To:,
>Date:, and Subject:. Possibly From:. What else?

RIPEM itself is not smart enough to selectively copy some headers and
not others into the plaintext; it will either copy all of them or none
of them.

The perl script I wrote, send-ripem, is more selective.  It includes all
headers except Bcc (which obviously shouldn't be included in the
plaintext) and Fcc (which is only meaningful for MH.)  You may find the
perl code in send-ripem of use; feel free to borrow from it.  (Let me
know if you don't have a copy, I'll gladly send you one.)

(Getting a mailer interface which handles Bcc properly for full-fledged
encryption is more difficult to do, but doable.)

I recommend From:, Date:, and To: at minimum; this is sufficient to
prevent replay attacks (provided the recipient pays attention), and has
the added benefit of making the plaintext an RFC 822 compliant message.
Bcc: is the only header for which I can think of a good reason *not* to
include it in the plaintext.
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted
"I used to sing the blues when I was feelin' so down."
"What do you do now?"
"Post to sci.research.careers."