[pe-users] Re: [TL-Security-Announce] mtr-0.41 and earlier TLSA2000003-1 (fwd)

[L. S. <ra...@qu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ah, yes. I should have investigated the situation more thoroughly. :)

And you said their key isn't on the keyservers; I assume you checked both
NAI's as well?


On Fri, 10 Mar 2000, Frank Tobin wrote:

> L. Sassaman, at 00:24 -0800 on Fri, 10 Mar 2000, wrote:
> 
> > Try running this message through PGPEnvelope. I think it is getting
> > confused by the key included in the key included in the message.
> 
> I noticed this too; first I'd like to rant one-line rant that TL is
> moronic to include the key in the messages (it wasn't even on the
> keyservers!  But I changed that. :) .  That being said, I'll continue.
> 
> There is something interesting going on.  Note TL sent several messages to
> BugTraq; only the first, the one about mtr, fails.  The ones about man and
> htdig pgpenvelope succeeds on; these also have a public key nested inside,
> and pgpenvelope handles these okay.
> 
> I also note also note that the message that failed (the mtr one) was a
> forwarded message (while the others were re-directs, or something).  This
> message does _not_ verify in gnupg; it is not pgpenvelope's fault.  The
> reason is that TL the forwarded message contains unescaped lines that
> begin with dashes (escaping these includes prepending them with a dash
> followed by a space).
> 
> Note the line (in raw format, in your signed-backup folder, if you have
> it):
> 
> ----------------------------------------------------------------------------
> 966e78977e5847d817efed904009f467	mtr-0.42-1.i386.rpm
> 
> It should be:
> 
> - ----------------------------------------------------------------------------
> 966e78977e5847d817efed904009f467	mtr-0.42-1.i386.rpm
> 
> Hence, the person who resent this mesage
> invalidated the message for you.  I can't do anything about that.  It
> seems this person gained a few braincells for forwarding the message to
> BugTraq the next couple times, though.
> 
> -- 
> Frank Tobin		http://www.neverending.org/~ftobin/
> 
> "To learn what is good and what is to be valued,
> those truths which cannot be shaken or changed."  Myst: The Book of Atrus
> 

__

L. Sassaman

System Administrator                |  "All of the chaos
Technology Consultant               |   Makes perfect sense..."
icq.. 10735603                      |
pgp.. finger://ns.quickie.net/rabbi |              --Joe Diffie



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: OpenPGP Encrypted Email Preferred.

iD8DBQE4yLtDPYrxsgmsCmoRAlBSAKCthc9PWKrnjLt0aGosw72w3G6vYACg7FWe
CoQQwPkwooyV6+xsj18/ims=
=9bM4
-----END PGP SIGNATURE-----