Re: [cryptography] Is it just me or is this fundamentally broken?

2013-03-05 Thread ianG
On 5/03/13 02:42 AM, Peter Gutmann wrote: Quoting http://xmpp.org/extensions/xep-0027.html#signing: Signing enables a sender to verify that they sent a certain block of text. [...] The text that is signed MAY be the empty string. (There's no metadata or anything there, just a raw

Re: [cryptography] Is it just me or is this fundamentally broken?

2013-03-05 Thread Peter Saint-Andre
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 3/5/13 5:17 AM, ianG wrote: On 5/03/13 02:42 AM, Peter Gutmann wrote: Quoting http://xmpp.org/extensions/xep-0027.html#signing: Signing enables a sender to verify that they sent a certain block of text. [...] The text that is signed MAY be

[cryptography] Is it just me or is this fundamentally broken?

2013-03-04 Thread Peter Gutmann
Quoting http://xmpp.org/extensions/xep-0027.html#signing: Signing enables a sender to verify that they sent a certain block of text. [...] The text that is signed MAY be the empty string. (There's no metadata or anything there, just a raw signature). Peter.

Re: [cryptography] Is it just me or is this fundamentally broken?

2013-03-04 Thread Peter Saint-Andre
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 3/4/13 4:42 PM, Peter Gutmann wrote: Quoting http://xmpp.org/extensions/xep-0027.html#signing: Signing enables a sender to verify that they sent a certain block of text. [...] The text that is signed MAY be the empty string. (There's no

Re: [cryptography] Is it just me or is this fundamentally broken?

2013-03-04 Thread Peter Gutmann
Peter Saint-Andre stpe...@stpeter.im writes: No one uses XEP-0027 these days, they all use OTR. The PGP integration with XMPP clients was an early experiment in the Jabber community before we even called it XMPP. Think 13+ years ago. But clients never signed empty strings, although we never fixed