[47431] in Cypherpunks
Re: A weakness in PGP signatures, and a suggested solution (long)
daemon@ATHENA.MIT.EDU (Bryce)
Wed Jan 17 20:10:01 1996
To: llurch@networking.stanford.edu
Cc: cypherpunks@toad.com
Reply-To: bryce@colorado.edu
In-Reply-To: Your message of "Wed, 17 Jan 1996 16:05:07 MST."
Date: Wed, 17 Jan 1996 16:09:13 -0700
From: Bryce <wilcoxb@nag.cs.colorado.edu>
-----BEGIN PGP SIGNED MESSAGE-----
An entity calling itself Rich Graves
<llurch@Networking.Stanford.EDU> allegedly wrote:
>
> An easy short-term partial solution would be to modify mailcrypt, bap, or
> whatever front end you use to automatically put the current date and (a
> shortened form of) the To: or Newsgroups: header into the PGP signature
> Comments: line.
I wrote:
>
> A good idea, and one I was about to implement for BAP, but
> doesn't PGP itself stick a timestamp into the signature?
> When I verify a signature it says "verified, signed at
> XXX time & date.".
Whoops! I misunderstood. The fix I am considering is putting
some information inside the *body* of the message, probably at
the end just before the signature.
Regards,
Bryce
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01
iQCVAwUBMP2Bj/WZSllhfG25AQHxWwP/bHmOcuAPAHdCShaeZhpLYQPJEJWyApuV
EQhA/k1TSxmowH0cPff1rBZw4+2HFzfKiWHgBO12lf6gO+ihVGq/7GAJuwEVmMb6
aNKhSRESmb2YgV8/luj401KnknSP1x3xC56wzE1mhIiN8LOtav2J+rxM398DTzEc
8mzb7dETBRU=
=ZDiw
-----END PGP SIGNATURE-----
