Subject: Re: V5 signatures

From: "William H. Geiger III" <[email-masked]>
Date: Fri, 18 Jun 1999 09:48:00 -0500

In <[email-masked]>, on 05/28/99 
   at 05:37 AM, Werner Koch <[email-masked]> said:

>Werner Koch <[email-masked]> writes:

>> However, the octet count for the [un]hashed subpackets is limited to
>> 65535.

>It just came to my mind, that large signature packets (currently they
>have a limit of about 128k) do impose a problem:

>It will then not be possible to keep the complete signature packet in
>memory.  Signatures may be (theoretical) very large - up to 4 Gigs and
>due to this they have to be handled like plaintext.

>Doess it really make sense to build a protocol - based on OpenPGP - 
>which puts all it's dat into a signature packet?  Such data should go
>into a literal text packet or some new packet type.
> 

IMNSHO it is brain dead to stuff data into signature packets. It is not
where it belongs. PGP has a very nice and simple signature format: A hash
of the data encrypted with the signer's public key. That's all that needs
to be there, no need to start bloating out the signatures.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii

Hi Jeff!! :)
---------------------------------------------------------------

---

From: Jon Callas <[email-masked]>
Date: Fri, 18 Jun 1999 17:06:27 -0700

At 7:48 AM -0700 6/18/1999, William H. Geiger III said:

So don't do that.

The reason I want it there is so that someone, if they wanted to, could
make a "bloated" signature. An example of why you might want to do this is
PGPticket. These are very light weight authorization certificates. Vinnie
has a great example of using this. He has a file-server extension that
accepts tickets and can allow you access to the server simply by writing
you an appropriate ticket. It's very cool, and works really nicely.

I cannot conceive of why you would need more than 8383 bytes in a ticket
(or 64K), either, but all my years of design have taught me that you never
regret making a length field idiotically big. The gods punish hubris, and
in protocol design, two-byte lengths are hubris.

	Jon

---

From: [email-masked] (Bodo Moeller)
Date: Mon, 21 Jun 1999 23:32:49 +0200 (CEST)

"William H. Geiger III" <[email-masked]>:

> of the data encrypted with the signer's public key. [...]

You mean "private key", obviously, but in any case that phrase should
be eliminated from discussions on digital signatures.  Signatures are
not about encrypting; it's just that in the scheme abstractly
described by Diffie and Hellman and made practically by Rivest, Shamir
and Adleman, signing and decryption are done in the same way.  This is
not true in general, and particularly not for ElGamal and DSA
signatures.