ietf-openpgp
[Top] [All Lists]

RFC 2015 problems

1998-03-10 05:09:21
[A copy of this goes to ietf-open-pgp.]

While thinking about further development of the PGP
integration with the mutt mail user agent, I am starting
to stumble over some problems with RFC 2015.

First, what's the plan?  The last two pgp related patches
are steps in the direction of an even more general PGP
integration which should allow mutt to automatically
select the correct PGP version to decrypt a message or
verify a signature.

To do this, we need some information about the algorithms
in use; this information has to be extracted from the
message's MIME headers since we don't want to parse the
PGP bodies ourselves.

The "micalg" parameter for PGP/MIME _signed_ messages is
one step in that direction - it would permit us to select
the correct "PGP" version for verifying signatures under
certain circumstances.

But there is no such parameter for encrypted messages, and
there is none for the encrypt/sign combo PGP permits to
generate.

Additionally, there may be "PGP" implementations which
permit various combinations of mic algorithms and
asymmetric algorithms, like rsa-rmd160, rsa-sha1,
elgamal-rmd160, elgama-md5, etc.

It is not possible for a mail user agent to handle such
versions properly - does micalg="pgp-sha1" mean a DSA
signature like pgp-5 generates it, or does it mean some
strange rsa-sha1 combination which has to be read by a
different "PGP" version?

How do you suggest to handle these problems? Are there any
plans for extensions to RFC 2015 to address them?

tlr
-- 
Thomas Roessler · 74a353cc0b19 · dg1ktr · http://home.pages.de/~roessler/
     2048/CE6AC6C1 · 4E 04 F0 BC 72 FF 14 23 44 85 D1 A1 3B B0 73 C1

<Prev in Thread] Current Thread [Next in Thread>