Subject: S2K Question
From: Stephen Paul Weber <[email-masked]>
To: [email-masked]
Date: Wed, 31 Mar 2010 18:24:03 -0500
List-Id: <ietf-openpgp.imc.org>

I think I get simple and salted, but iterated and salted is a bit complex.

Is it:

key = "";
count = ((Int32)16 + (c & 15)) << ((c >> 4) + 6);
for(i = 0; i < count; i++) {
	key = hash_function(strcat(key, passphrase[i]));
}

- -- 
Stephen Paul Weber, @singpolyma
Please see <http://singpolyma.net> for how I prefer to be contacted.
edition right joseph

Date: Wed, 31 Mar 2010 09:57:33 -0500
From: Stephen Paul Weber <[email-masked]>
To: David Shaw <[email-masked]>
Cc: [email-masked]
Subject: Re: Question about verifying signatures
Jabber-ID: [email-masked]
OpenPGP: id=CE519CDE; url=https://singpolyma.net/public.asc
Sender: [email-masked]

Somebody claiming to be David Shaw wrote:
> To paraphrase 5.2.4, and assuming we're talking about V4 signatures, you =
take all the data (just the uncompressed literal packet body - not includin=
g the literal packet header), and follow that with the signature version (1=
 byte), the signature type (1 byte), the public-key algorithm (1 byte), the=
 hash algorithm (1 byte), the hashed subpacket length (2 bytes, big endian)=
, and the hashed subpacket body (however many bytes).  Note that these are =
the first n bytes of your signature packet.  Then you hash the trailer: 0x0=
4, 0xFF, and a four byte big-endian number which is the number of bytes you=
 hashed from the signature (i.e. 6 bytes, plus the number of subpacket byte=
s).

I've finally got one to work.  The "message" that the signature is over
seems to be the concatenation of the literal data in the literal packet (not
header or filename or timestamp) with the bits in your message, in that
order.

Thanks for all the help!

- --=20
Stephen Paul Weber, @singpolyma
Please see <http://singpolyma.net> for how I prefer to be contacted.
edition right joseph

Subject: Re: Question about verifying signatures
From: David Shaw <[email-masked]>
Date: Tue, 30 Mar 2010 21:53:45 -0400
Cc: [email-masked]
To: Stephen Paul Weber <[email-masked]>
Sender: [email-masked]

On Mar 30, 2010, at 4:20 PM, Stephen Paul Weber wrote:

> I'm reading RFC4880 in an attempt to produce an implementatdion of a =
subset
> of OpenPGP (RSA signatures) using <http://phpseclib.sourceforge.net/>. =
 I
> have the publickey and compression-literal-signature packets parsed =
out.  I
> can extract n and e and feed them to Crypt_RSA to construct a =
verifier.  I
> tell it I'm using sha256.  It then needs a "message" and a "signature"
> parametre.  I get the signature data out of the signature packet no =
problem.
> The question I have is: what is "message"?  According to section 5.2.4 =
it's
> some combination of the literal data packet(s?) (their bodies or the =
whole
> packet?) and the "hashed" subpackets.  Do I just concat all the data =
packets
> and the hashed packets together in the order they appear?

Basically, yes.

To paraphrase 5.2.4, and assuming we're talking about V4 signatures, you =
take all the data (just the uncompressed literal packet body - not =
including the literal packet header), and follow that with the signature =
version (1 byte), the signature type (1 byte), the public-key algorithm =
(1 byte), the hash algorithm (1 byte), the hashed subpacket length (2 =
bytes, big endian), and the hashed subpacket body (however many bytes).  =
Note that these are the first n bytes of your signature packet.  Then =
you hash the trailer: 0x04, 0xFF, and a four byte big-endian number =
which is the number of bytes you hashed from the signature (i.e. 6 =
bytes, plus the number of subpacket bytes).

Note that the data (literal packet contents) might be tagged as binary =
(0x00) or text (0x01) (the tag is in the literal packet header).  They =
are the same, except that text has its line endings canonicalized to =
CRLF.

David

Date: Tue, 30 Mar 2010 20:46:52 -0500
From: Stephen Paul Weber <[email-masked]>
To: Wim Lewis <[email-masked]>
Cc: [email-masked]
Subject: Re: Question about verifying signatures
Jabber-ID: [email-masked]
OpenPGP: id=CE519CDE; url=https://singpolyma.net/public.asc
Sender: [email-masked]

Somebody claiming to be Wim Lewis wrote:
> I agree that paragraph isn't completely unambiguous. IIRC, the data
> passed to the SHA1/MD5/whatever algorithm is the bare document
> contents (possibly with EOL canonicalization as described above),
> concatenated with some "trailer" bytes which depend on the version
> number of the signature, but are a copy of part of the signature
> subpacket itself plus perhaps a length field and so on (see the last
> three paragraphs of [5.2.4]).

So, I'm concatenating:

* The literal contents of any literal data packet(s).
* The literal bytes of the signature packet up to and including the "hashed"
  subpackets
* 0x04
* 0xFF
* The length of the second thing in this list

As the "message" to hash?  I'm going to try that.

- -- 
Stephen Paul Weber, @singpolyma
Please see <http://singpolyma.net> for how I prefer to be contacted.
edition right joseph

Date: Tue, 30 Mar 2010 15:18:28 -0700 (PDT)
From: Wim Lewis <[email-masked]>
To: Stephen Paul Weber <[email-masked]>
cc: [email-masked]
Subject: Re: Question about verifying signatures
Sender: [email-masked]

On Tue, 30 Mar 2010, Stephen Paul Weber wrote:
> The question I have is: what is "message"?  According to section 5.2.4 it's
> some combination of the literal data packet(s?) (their bodies or the whole
> packet?) and the "hashed" subpackets.  Do I just concat all the data packets
> and the hashed packets together in the order they appear?

Section [5.2.4] says:
> For binary document signatures (type 0x00), the document data is
> hashed directly.  For text document signatures (type 0x01), the
> document is canonicalized by converting line endings to <CR><LF>,
> and the resulting data is hashed.

I agree that paragraph isn't completely unambiguous. IIRC, the data passed 
to the SHA1/MD5/whatever algorithm is the bare document contents (possibly 
with EOL canonicalization as described above), concatenated with some 
"trailer" bytes which depend on the version number of the signature, but 
are a copy of part of the signature subpacket itself plus perhaps a length 
field and so on (see the last three paragraphs of [5.2.4]).

(The encrypted-data packet, by contrast, does contain a sequence of 
OpenPGP packets.)

Date: Tue, 30 Mar 2010 15:20:49 -0500
From: Stephen Paul Weber <[email-masked]>
To: [email-masked]
Subject: Question about verifying signatures
Jabber-ID: [email-masked]
OpenPGP: id=CE519CDE; url=https://singpolyma.net/public.asc
Sender: [email-masked]

I'm reading RFC4880 in an attempt to produce an implementatdion of a subset
of OpenPGP (RSA signatures) using <http://phpseclib.sourceforge.net/>.  I
have the publickey and compression-literal-signature packets parsed out.  I
can extract n and e and feed them to Crypt_RSA to construct a verifier.  I
tell it I'm using sha256.  It then needs a "message" and a "signature"
parametre.  I get the signature data out of the signature packet no problem.
The question I have is: what is "message"?  According to section 5.2.4 it's
some combination of the literal data packet(s?) (their bodies or the whole
packet?) and the "hashed" subpackets.  Do I just concat all the data packets
and the hashed packets together in the order they appear?

Thanks.

- -- 
Stephen Paul Weber, @singpolyma
Please see <http://singpolyma.net> for how I prefer to be contacted.
edition right joseph