I-D ACTION:draft-ietf-openpgp-mime-05.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the An Open Specification for Pretty Good Privacy Working Group of the IETF.

	Title		: MIME Security with OpenPGP
	Author(s)	: M. Elkins, D. Del Torto, R. Levien, T. Roessler
	Filename	: draft-ietf-openpgp-mime-05.txt
	Pages		: 13
	Date		: 01-Mar-01
	
This document describes how the OpenPGP Message Format [1] can be
used to provide privacy and authentication using the Multipurpose
Internet Mail Extensions (MIME) security content types described in
RFC1847 [2].
This draft is being discussed on the 'ietf-openpgp' mailing list.  To
join the list, send a message to <ietf-openpgp-request <at> imc.org> with
the single word 'subscribe' in the subject.  An archive of the
working group's list is located at <http://www.imc.org/ietf-openpgp>.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-openpgp-mime-05.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-openpgp-mime-05.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Re: PGP/MIME implementors: text mode vs. binary mode?

Re: PGP/MIME implementors: text mode vs. binary mode?

On 2001-03-05 09:28:14 -0800, John W Noerenberg II wrote:

> Have you considered the implications of format=flowed (rfc2646)?
> Specifically:

> 4.6.  Digital Signatures and Encryption
> 
>     If a message is digitally signed or encrypted it is important that
>     cryptographic processing use the on-the-wire Format=Flowed format.
>     That is, during generation the message SHOULD be prepared for
>     transmission, including addition of soft line breaks, space-stuffing,
>     and [Quoted-Printable] encoding (to protect soft line breaks) before
>     being digitally signed or encrypted; similarly, on receipt the
>     message SHOULD have the signature verified or be decrypted before
>     [Quoted-Printable] decoding and removal of stuffed spaces, soft line
>     breaks and quote marks, and reflowing.

That's perfectly compatible with draft-05: Trailing white space will
be protected by the quoted-printable encoding of the flowed text, so
there is _no_ trailing whitespace in the signed material as the hash
algorithm sees it.

--

-- 
Thomas Roessler			    <roessler <at> does-not-exist.org>
This message may  have been certified to  be possibly virus-free.

Re: PGP/MIME implementors: text mode vs. binary mode?

At 7:16 PM +0100 3/5/01, Thomas Roessler wrote:
>
>That's perfectly compatible with draft-05: Trailing white space will
>be protected by the quoted-printable encoding of the flowed text, so
>there is _no_ trailing whitespace in the signed material as the hash
>algorithm sees it.

Well done.

interoperability testing of OpenPGP

I'm investigating the possibility of hosting an openpgp 
interoperability testing workshop (there's another name for this, but 
Pillsbury seems to think it is improper for other organizations to 
use it) at Qualcomm in our San Diego facilities.  I'd like to know 
how many people would be interested in participating, particularly 
those willing to come in person.  Please respond to me personally 
(rather than litter the mailing list).  I'll summarize and report 
back.

Phil Zimmerman and I have discussed this, and it would be in 
connection with the OpenPGP Consortium he is organizing.  This has 
particular value for this WG, since it will help us assess where we 
stand w/r/t DRAFT status for rfc2440.  I am hopeful there will be 
several willing and able to participate!

best,
--

-- 

john noerenberg
jwn2 <at> qualcomm.com
   --------------------------------------------------------------------------
   Peace of mind isn't at all superficial, really.  It's the whole thing.
   That which produces it is good maintenance; that which disturbs it
   is poor maintenance.
   -- Zen and the Art of Motorcycle Maintenance, Robert M. Pirsig, 1974
   --------------------------------------------------------------------------

Re: Finalizing OpenPGP/MIME? - Mtg in Mpls

Compatibility testing goals and planning

Earlier this month I proposed an interoperability testing meeting for 
OpenPGP.  A number of people have responded they are interested in 
participating, and I've given some more thought to what we want to 
accomplish.  Rod Thayer and I had the opportunity to discuss it 
further today, and a plan is beginning to take shape.

The OpenPGP Oven-Cooking Competition (in deference to a local 
Minneapolis company who feels another name impinges their reputation) 
is intended to test compliance with 2440 in a variety of scenarios. 
I'll provide a compliance matrix for the 2440 requirements that 
implementers can use as a guide.  The matrix will be reviewed both by 
Rod and by Jon Callas to make sure I haven't missed anything 
important, or misstated anything.  And, of course, it will be 
published to this list as soon as possible for your review.  Uses of 
OpenPGP we anticipate testing are PGP/MIME, TLS over OpenPGP, and 
IPSec over OpenPGP.  We'll verify interoperation of key generation, 
signing and verification.  We're considering ways to verify key 
server interoperability.  However, there are no published protocols 
for this.  So I'm not sure what we can accomplish in this area.  We'd 
like to test implementations of the AES algorithms, as well as the 
mandated algorithms in 2440.   Execution speed isn't nearly as 
important as correct execution of the protocols and underlying 
algorithms. But bear in mind that I don't expect the meeting to last 
more than 2 days. <grin>

Rod will create a more detailed test plan which we'll publish for 
comments on the list.  I'd like to aim at holding the Oven-Cooking 
Competition sometime during June or July so that we can publish our 
status on 2440 in time for the London meeting.  Some people have 
indicated they won't be able to participate in person, so one of the 
things I'll arrange is a means for people to also test remotely. 
However, I want to emphasize how valuable face-to-face meetings are 
for interoperability testing.  We'll be able to solve problems 
interactively, and discover issues that otherwise may take a long 
time to surface.

These are my general goals for the meeting.  Please comment and offer 
suggestions.  That's the best way to insure this little confab serves 
your needs as implementers and users of OpenPGP.

--

-- 

john noerenberg
jwn2 <at> qualcomm.com
   --------------------------------------------------------------------------
   Peace of mind isn't at all superficial, really.  It's the whole thing.
   That which produces it is good maintenance; that which disturbs it
   is poor maintenance.
   -- Zen and the Art of Motorcycle Maintenance, Robert M. Pirsig, 1974
   --------------------------------------------------------------------------

Re: Compatibility testing goals and planning

John , Rodney & JON :

I think this a wonderfull idea whose time has come.

I'm involved in agreat deal of PGP training to english and non-english 
audiences and am particularly interested in how different implementations 
handle non USA ASCII text. If this aspect of testing might be of interest, 
please do let me know..as more than happy to help

Regards,

Robert
ps.

--On Monday, March 19, 2001 7:50 PM -0600 John W Noerenberg II 
<jwn2 <at> qualcomm.com> wrote:

> Earlier this month I proposed an interoperability testing meeting for
> OpenPGP.  A number of people have responded they are interested in
> participating, and I've given some more thought to what we want to
> accomplish.  Rod Thayer and I had the opportunity to discuss it further
> today, and a plan is beginning to take shape.
>
> The OpenPGP Oven-Cooking Competition (in deference to a local Minneapolis
> company who feels another name impinges their reputation) is intended to
> test compliance with 2440 in a variety of scenarios. I'll provide a
> compliance matrix for the 2440 requirements that implementers can use as
> a guide.  The matrix will be reviewed both by Rod and by Jon Callas to
> make sure I haven't missed anything important, or misstated anything.
> And, of course, it will be published to this list as soon as possible for
> your review.  Uses of OpenPGP we anticipate testing are PGP/MIME, TLS
> over OpenPGP, and IPSec over OpenPGP.  We'll verify interoperation of key
> generation, signing and verification.  We're considering ways to verify
> key server interoperability.  However, there are no published protocols
> for this.  So I'm not sure what we can accomplish in this area.  We'd
> like to test implementations of the AES algorithms, as well as the
> mandated algorithms in 2440.   Execution speed isn't nearly as important
> as correct execution of the protocols and underlying algorithms. But bear
> in mind that I don't expect the meeting to last more than 2 days. <grin>
>
> Rod will create a more detailed test plan which we'll publish for
> comments on the list.  I'd like to aim at holding the Oven-Cooking
> Competition sometime during June or July so that we can publish our
> status on 2440 in time for the London meeting.  Some people have
> indicated they won't be able to participate in person, so one of the
> things I'll arrange is a means for people to also test remotely. However,
> I want to emphasize how valuable face-to-face meetings are for
> interoperability testing.  We'll be able to solve problems interactively,
> and discover issues that otherwise may take a long time to surface.
>
> These are my general goals for the meeting.  Please comment and offer
> suggestions.  That's the best way to insure this little confab serves
> your needs as implementers and users of OpenPGP.
>
> --
>
> john noerenberg
> jwn2 <at> qualcomm.com
>
> --------------------------------------------------------------------------
>    Peace of mind isn't at all superficial, really.  It's the whole thing.
>    That which produces it is good maintenance; that which disturbs it
> is poor maintenance.
>    -- Zen and the Art of Motorcycle Maintenance, Robert M. Pirsig, 1974
>
> --------------------------------------------------------------------------

Robert Guerra <rguerra <at> yahoo.com>
WWW: http://www.geocities.com/rguerra/

editorial commnets for openpgp-mime-05

Hi all,

I read openpgp-mime-05 for the meeting today. I think this version
is quite reasonable.

Here are editorial commnets for openpgp-mime-05:

(1) page 3, note:

Two "From" should be "From ". The last SPC is very important since
MTAs don't convert a line started with "From" (not "From ") to
">From".

(2) page 6

There are two item (4). (4) and (5) should be (5) and (6),
respectively.

--Kazu

Re: editorial commnets for openpgp-mime-05

On 2001-03-20 22:11:20 +0900, Kazu Yamamoto wrote:

> I read openpgp-mime-05 for the meeting today. I think this version
> is quite reasonable.

> Here are editorial commnets for openpgp-mime-05:

Thanks.  I fixed that in the version of the document which resides
here.

--

-- 
Thomas Roessler			    <roessler <at> does-not-exist.org>