Re: forgery patch tests(fwd)

[Billy D. <bi...@da...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 8 Oct 2000, Frank Tobin wrote:

> Billy Donahue, at 07:36 -0400 on Tue, 3 Oct 2000, wrote:
> 
> > Here's a test message after passing through the forgery filter.
> > My actual pgpenvelope borders are set to be:
> 
> I've applied software changes based on the patches you sent (changed a
> little bit to improve efficiency), but unfortunately, I can't replicate
> the behaviour you are getting, even with applying your patch directly.
> For example, my default border is:
> 
> > -----pgpenvelope processed message-----
> 
> (without "> ")
> 
> The following does not trip properly; e.g., it matches at index 34, not 0:
> 
> > -----agpenvelope processed message-----
.                                     ^
.   0....5....0....5....0....5....0....

Okay, that's weird.  Here's what I'm using to diagnose it...

cat <<"EOF" >approxmatch.pl
#!/usr/bin/perl
use String::Approx qw( aindex );
($thresh,$pattern,$in) = @ARGV;
$fmt = "%10s: %s\n";
printf $fmt, "thresh", $thresh;
printf $fmt, "pattern", $pattern;
printf $fmt, "in", $in;
$at = aindex( $pattern, [ $thresh ], $in );
print "index of match: $at\n";
print "$pattern\n";
print " "x$at ."$in\n";
EOF
perl ./approxmatch.pl '5' \
  '-----pgpenvelope processed message-----' \
  '-----agpenvelope processed message-----'


producing: 

    thresh: 5
   pattern: -----pgpenvelope processed message-----
        in: -----agpenvelope processed message-----
index of match: 34
- -----pgpenvelope processed message-----
                                  -----agpenvelope processed message-----



The result index jumps from 0 to 34 when the threshold hits 6.
The 5 first characters match the last 5 characters of your border.
I guess the aindex doesn't find the BEST match, just A match inside
the threshold.. that's kinda crazy.

What does this mean?  It means that someone can send you a message with
the '-----agpenvelope processed message-----' line and it would and pass
undetected through your forgery filter because at position 34.  the
decryptor would think it was seeing a quoted border.  Hm.. interesting problem.

I think this might be a bug in String::Approx.  It's obviously a mistake
to say that these two strings are only 5 edits of distance from each
other when positioned at a 34 character offset from each other.



- --
"The Funk, the whole Funk, and nothing but the Funk."
Linux barcode software mirror: http://dadadada.net/cuecat
Billy Donahue <mailto:bi...@da...>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: pgpenvelope 2.9.0 - http://pgpenvelope.sourceforge.net/

iD8DBQE54HSP+2VvpwIZdF0RAoXaAKCFpNDj85IeF64XQkbZXApNiJPe1wCgm+IB
/+vdEsg0IVXjVZD8KpWtTJI=
=EJxK
-----END PGP SIGNATURE-----