pgp2.0 signature security problem

Thread View: sci.crypt

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Rob Stampfli Sat, 12 Sep 1992 17:43

#909

Author: Rob Stampfli
Date: Sat, 12 Sep 1992 17:43

19 lines
1054 bytes

I recently had a chance to play around with pgp2.0 on a sVr2 Unix machine.
There appears to be a big security problem with the signature mechanism:
If you "sign" a file, and then add additional information to the end of
the signed file, pgp includes this additional information as part of what
it says you signed.  For instance:

echo 1 2 3 4 5 | pgp -fs >xyzzy.pgp
echo 6 7 8 9 10 >>xyzzy.pgp
pgp xyzzy.pgp

pgp now tells me I have signed the phrase:

	1 2 3 4 5
	6 7 8 9 10

when I have in fact only signed the first line.
-- 
Rob Stampfli  rob@colnet.cmhnet.org      The neat thing about standards:
614-864-9377  HAM RADIO: kd8wk@n8jyv.oh  There are so many to choose from.

Re: pgp2.0 signature security problem

#940

Author: Mark Henderson
Date: Mon, 14 Sep 1992 19:17

55 lines
2144 bytes

In article <1992Sep12.174358.11564@colnet.cmhnet.org> res@colnet.cmhnet.org (Rob Stampfli) writes:
>I recently had a chance to play around with pgp2.0 on a sVr2 Unix machine.
>There appears to be a big security problem with the signature mechanism:
>If you "sign" a file, and then add additional information to the end of
>the signed file, pgp includes this additional information as part of what
>it says you signed.  For instance:
>
>echo 1 2 3 4 5 | pgp -fs >xyzzy.pgp
>echo 6 7 8 9 10 >>xyzzy.pgp
>pgp xyzzy.pgp
>
>pgp now tells me I have signed the phrase:
>
>	1 2 3 4 5
>	6 7 8 9 10
>
>when I have in fact only signed the first line.
>-- 
>Rob Stampfli  rob@colnet.cmhnet.org      The neat thing about standards:
>614-864-9377  HAM RADIO: kd8wk@n8jyv.oh  There are so many to choose from.

The following may be a fix. I haven't tested it extensively, it may
very well screw something else up.

Mark

*** crypto.c.orig	Mon Sep 14 10:31:12 1992
--- crypto.c	Mon Sep 14 10:31:48 1992
***************
*** 1494,1505 ****
  		}
  		CONVERSION = (lit_mode == MODE_TEXT) ? EXT_CONV : NO_CONV;
  #ifdef CANONICAL_TEXT
! 		copyfile(f,g,-1L);	/* copy rest of file from file f to g */
  #else
  		if (lit_mode == MODE_BINARY)
! 			copyfile( f, g, -1L );
  		else
! 			copyfile_from_canon( f, g, -1L );
  #endif
  		CONVERSION = NO_CONV;
  
--- 1494,1505 ----
  		}
  		CONVERSION = (lit_mode == MODE_TEXT) ? EXT_CONV : NO_CONV;
  #ifdef CANONICAL_TEXT
! 		copyfile(f,g,text_len);	/* copy rest of file from file f to g */
  #else
  		if (lit_mode == MODE_BINARY)
! 			copyfile( f, g, text_len );
  		else
! 			copyfile_from_canon( f, g, text_len );
  #endif
  		CONVERSION = NO_CONV;

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads