signature inside a signature issue

Did you know that the file being sent to be verified was corrupted?

we may be talking about the same file
the files following the --verify <this file>

ooh I actually see where the problem lies :-)

in cgpg.js verify
replacing text

an idea about what is going wrong. After removing all the text replacement and sending the full content of the selected text it was able to verify my example
I see what you are trying to do and I think I understand the issue. I'd like to introduce and idea of layer searching
as you know a signature inside a signature appends "- " in front so when you search for a close to this you should look for an equal amount of "- "'s at the beginning
we can step through text a little at a time.

I'll try and write something up to demonstrate my idea.

also to append my idea I know there is a limmit to how much can go in a text input box before it wraps and maybe introduce a wrapping before sending it to gpg.

The two things I don't like about this method are as follows
1. This is inband tokening meaning someone can mess up this algorithm using keywords like if FIREGPGTRALALABEGINHIHAN
2. to do verifying on inner messages would get difficult if we wish to do this later. I have ideas about doing that with my layered idea
if you want unbreakable inband we could do that too we could have counted how many instances we replaced and made up the space
difference with calculations instead of padding and then use an inband message replacement method like html does or shell escaping method
first replacing key tags with a key tag chain then replace the thing your going after then reverse that on the way back
example

lets say we want to replace "test" with &ourkeyphrase; lets first replace all & with & like html
example test phrase
"a tricky test phrase &"
we would first make our & substitution
"a tricky test phrase &amp;"
then we  do our substitutions
"a tricky &ourkeyphrase; &amp;"
now we have our working string after we are done we make the substitutions back
I'm using an html type method in this example.

now lets combine this with counting displacement characters
first we would count how many "&" 's we have and multiply that by 4 because we have 4 extra characters
then we would count how many "test" 's we have and multiply that by 10 because we have 10 extra characters.
add those numbers together and subtract them from our count total on our working phrase.
if we had less we would subtract

Last edited by jeff.sadowski (2007-06-22 02:33:26)

Counting mistake I made. I said count all "&" 's and "test" 's this is untrue we should only count the ones before the key word, and we should count our replaced items
"&" 's and "&ourphrase;" 's since the calculations are being done after the replacement.

Last edited by jeff.sadowski (2007-06-22 16:20:15)

ok sorry I'll try and edit more ;-)

oops I messed up the first time I did this I made some changes FIREGPGTRALALAENDHIHAN was too long

in file firegpg/content/cgpg.js
In the baseVerify function
I changed

from
text = text.replace(reg, "FIREGPGTRALALABEGINHIHAN");
to
text = text.replace(reg, "FIREGPGTRALALABEGINHIHAN123456789012");

and

from
text = text.replace(reg, "FIREGPGTRALALAENDHIHAN");
to
text = text.replace(reg, "FIREGPGTRALALAENDHIHAN1234567");

and

from
reg = new RegExp("FIREGPGTRALALABEGINHIHAN", "gi");
to
reg = new RegExp("FIREGPGTRALALABEGINHIHAN123456789012", "gi");

and

from
text = text.replace(reg, "-----BEGIN PGP SIGNED MESSAGE-----");
to
text = text.replace(reg, "- -----BEGIN PGP SIGNED MESSAGE-----");

and

from
reg = new RegExp("FIREGPGTRALALAENDHIHAN", "gi");
to
reg = new RegExp("FIREGPGTRALALAENDHIHAN1234567", "gi");

and

from
text = text.replace(reg, "-----END PGP SIGNATURE-----");
to
text = text.replace(reg, "- -----END PGP SIGNATURE-----");

Last edited by jeff.sadowski (2007-06-22 20:05:54)

yes it fixes this problem

Notes: as originally intended it just validaes the outside signature and the first one

example 1:

--begin sig 1--
- --begin sig 2--
- --end sig 2--
--end sig 1--
--beging sig 3--
--end sig 3--

only sig 1 is validated sig 3 is ignored this looked to me like the original intention

example 2:

--begin sig 1--
--end sig1--
--begin sig2--
- --begin sig3--
- --end sig3--
--end sig2--

again only sig 1 is validated everything after --end sig1-- is ignored.

latter I will demonstrate my nested validating :-)

Last edited by jeff.sadowski (2007-06-22 21:33:35)

better fix :-)

baseVerify: function(text) {
        this.initGPGACCESS();

        var text = "\n" + text + "\n"; //add new line chars so we can use the following
        var begin = new RegExp("\n-----BEGIN PGP SIGNED MESSAGE-----\n");
        var end   = new RegExp("\n-----END PGP SIGNATURE-----\n");
        var firstPosition = text.search(begin);
        var lastPosition = text.search(end);

        // Verify GPG'data presence
        if(firstPosition == -1 || lastPosition == -1)
            return "noGpg";

        text = text.substring(firstPosition,lastPosition + ("-----END PGP SIGNATURE-----").length);

        // We get the result
        var result = this.GPGAccess.verify(text);

        // If check failled
        if(result.indexOf("GOODSIG") == "-1") {
            return "erreur";
        }
        else {
            // If he work, we get informations of the Key
            var infos = result;

            infos = infos.substring(0,infos.indexOf("GOODSIG") + 8);
            infos = result.replace(infos, "");
            infos = infos.substring(0,infos.indexOf("GNUPG") - 2);

            return infos;
        }
},