At 03:45 PM 3/25/98 +0100, Thomas Roessler wrote:
As a solution, I'd suggest to mandate the use of a certain
hash (sha1?) of the armored text, i.e., the _encrypted_
message. (Most probably it's meant that way, but let's
make the text unambiguous.)
An excellent point -- there needs to be clarification there. I've added
text that says, "...it MUST be computed from the finished (encrypted,
signed, etc.) message in a deterministic fashion..."
How's that?
Jon
-----
Jon Callas jon(_at_)pgp(_dot_)com
CTO, Total Network Security 4200 Bohannon Drive
Network Associates, Inc. Menlo Park, CA 94025
(650) 473-2860
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)