-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
test
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEzBAEBCAAdFiEE0OsqKVIE8xZ+slA87w6JZVeJWJsFAl4NONkACgkQ7w6JZVeJ WJuM6Qf/SH2d3WYB4KfzXqoZAAa5cf/pzSKl40f7s2jPs9rnw57HOYb8SLAG+ttx 5fpBLO2V3BWyYUXn2bY6KKIiI9gmjXuC9FP2JtkXPeV39LR8yeu2Ea1iWS/AI7jF GPNocdfYGbeOHSsDW/82HYygiT69DbLPUXGLn4ujAzpiHgbRDNqEidtJQdKfEG3z UZfw3L71uZCAK2tnaPTBsBle0y1r1cO+ZzMcBEU3SAOA2MekrJDrpWq1q67Z0ymq UfrN6PtrPlSOjpGg+8Jh1BMr4xXCQwYeTPiZrEO6lduKO2cyIOimlOXO8nJK1vUi U1l/zoz/KMbROMTYeJfdcc0FpWGLaA==
=8I23
-----END PGP SIGNATURE-----
wilfred@wilnux5:~/tmp> gpg --verify aug.msg
gpg: Signature made do 02 jan 2020 01:27:05 CET using RSA key ID 5789589B gpg: Can't check signature: No public key
wilfred@wilnux5:~/tmp> gpg --recv-keys 5789589B
gpg: requesting key 5789589B from hkp server keys.gnupg.net
gpgkeys: key 5789589B not found on keyserver
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
So where can we get your key?
So where can we get your key?
I just got started with this. I am not completely familiar how to use OpenPGP/Enigmail.
The following should be the right key for ID 5789589B
- -----BEGIN PGP PUBLIC KEY BLOCK-----
I can now verify your message had a correct signature made with
this key:
wilfred@wilnux5: ~/tmp> gpg -- import aug.key gpg: key
5789589B: public key "August Abolins
<august@R_E_M_O_V_Ekolico.ca>" imported gpg: Total number
processed: 1 gpg: imported: 1 (RSA: 1) wilfred@wilnux5
The trust thing is sort of an issue. I can't just sign your key (technically I could of course), because I can't verify it's
really you. Anyone could login to Tommy's nntp server
as 'August Abolins'. and "fake" email addresses are also easy
to create/get. And since you are not a node we can't even
exchange some crash netmails...
I can now verify your message had a correct signature made with
this key:
wilfred@wilnux5: ~/tmp> gpg -- import aug.key gpg: key
5789589B: public key "August Abolins
<august@R_E_M_O_V_Ekolico.ca>" imported gpg: Total number
processed: 1 gpg: imported: 1 (RSA: 1) wilfred@wilnux5
Cool! I still have to learn how to do that here.
I have used the pgp signing process in the long ago past, but now and
I am rusty and have only begun figuring out "the process" to use in
this new environment.
I like the Enigmail/OpenPGP integration in Thunderbird.
When pgp first came out found, I found it fascinating.
I immediately wondered why *wouldn't* anyone want to use it on a
regular basic for email exchanges.
I think my old public key is still out there. (I have not really
looked for it though. I don't remember the servers I used.)
The private key is probably still on a 3½ diskette, somewhere.
theThe trust thing is sort of an issue. I can't just sign your key
(technically I could of course), because I can't verify it's
really you. Anyone could login to Tommy's nntp server
as 'August Abolins'. and "fake" email addresses are also easy
to create/get. And since you are not a node we can't even
exchange some crash netmails...
Well.. there *is* the email clue above. ;) A few email exchanges, and
analysis of the headers could be one way to get confidence whether the email I claim to use above is really me or suspicious.
There is still a trust issue in this whole process for sure. At least
one other person who could actually vouch that I am who I am would be needed.
W.r.t nntp, another "August Abolins" could come from many different outside systems. True. But since registering on Tommi's system
requires human intervention, I don't think he would permit another me
to register on his system with exactly the same FN LN. So, technically
you could be confident that once you grab my public key from here,
future correspondences are from "the August Abolins originally seen on Tommi's system." ? :)
As a minimum, if Tommi were to sign my key, (since my messages are originating on *his* system, and we can be sure that he's the *real deal* operating his *own* system, and I had to be registered manually to have access) then that would be a nice vote of confidence.
There is another verification process I can suggest. I'll cover that later. And maybe I'll encrypt that message! <G>
I think my old public key is still out there. (I have not
really looked for it though. I don't remember the servers I
used.)
Afaik most key-servers are connected to each other these days,
and exchange keys on a regular basis. So if your key is out
there, it might be "everywhere".
When I search for "abolins" on my (default) key-server it finds
27 keys as old as from 1994. But none include a mention
of "august".
The private key is probably still on a 3S diskette, somewhere.
I have a lot of them still around (mainly Amiga formatted).
Haven't tried them in a few decades, and it would surprise me
if they are still readable.
There are configuration lines in my golded config to do gpg/pgp functions, but I can't remember when I last used them. Maybe never...
I like the Enigmail/OpenPGP integration in Thunderbird.
And in fidonet some systems wouldn't allow encrypted routed netmail messages to pass their systems... I remember there was a lot of discussion going on about that at the time.
As a minimum, if Tommi were to sign my key, (since my messages are
The one at MIT (which sounds like where I would have submitted my key)
but fails with this:
--[begin]--
Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /pks/lookup.
Reason: Error reading from remote server
--[end]--
I didn't expect that from the great MIT.
Afaik most key-servers are connected to each other these days,
and exchange keys on a regular basis. So if your key is out
there, it might be "everywhere".
Yes.. I notice that keys are now pooled and distributed to other servers. Things have certainly changed since I first started with PGP in the 90's.
I looked with a few listed here: https://sks-keyservers.net/status/
When I search for "abolins" on my (default) key-server it finds
27 keys as old as from 1994. But none include a mention
of "august".
Are they *all* from 1994?
1994 sounds about right when I actually submitted to a server. II
found about the same number of references to abolins as you at a few random servers from the sks link above. I am surprised that I wouldn't have included my FN. I wonder if the last entry in one of those
searches could be it!
pub 512R/246249F7 1994-02-16
The DATE and bit size certainly looks right. 1994 is about the last time
actually used pgp. And, I am pretty sure the key signature was smallbefore
I learned about the benefits of larger ones.
This is what I did with a bunch of 3 1/2 diskettes a few years ago:
http://kolico.ca/fidonet/echos/win95/index.html#diskettes
As an aside: I like the "status" page at https://sks-keyservers.net/status/
It would be fun to see a similar live version of something like that
for the modest 900 IP nodes. ..But I digress.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
There are configuration lines in my golded config to do gpg/pgp
functions, but I can't remember when I last used them. Maybe never...
I have (S)ign function set up in my GoldED. Nothing else. :)
I just signed the key of August. :)
gpg: WARNING: This key has been revoked by its owner!
gpg: This could mean that the signature is forged.
gpg: reason for revocation: No reason specified
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4944 C463 71C6 4E3E 6077 422B 36A7 031E 56CD F35B
... on this message. So you are using a revoked key!?
I just signed the key of August. :)
And where is it? If it's only in your keyring, it's not very usefull
for the rest of
the world, that you signed it. ;)
onegpg: WARNING: This key has been revoked by its owner!
gpg: This could mean that the signature is forged.
gpg: reason for revocation: No reason specified
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 4944 C463 71C6 4E3E 6077 422B 36A7 031E 56CD
F35B
... on this message. So you are using a revoked key!?
Interesting.. Why is GPG using the revoked one, when there is a working
available... Hmm...
I just signed the key of August. :)
And where is it? If it's only in your keyring, it's not very usefull
for the rest of
the world, that you signed it. ;)
It should have been uploaded to the keyserver.
And in fidonet some systems wouldn't allow encrypted routed
netmail messages to pass their systems... I remember there
was a lot of discussion going on about that at the time.
Yes, there was a lot discussion in finnish echos too.
, U, ENC. :)
I just signed the key of August. :)As a minimum, if Tommi were to sign my key..
This is the list I get:
I get that same one in my list, ..
..I can import it from the keyserver: ..
But afterwards it can't be listed: ..
This is what I did with a bunch of 3 1/2 diskettes a few
years ago: ..
You have too much time! ;)
As an aside: I like the "status" page at
https://sks-keyservers.net/status/
It would be fun to see a similar live version of something
like that for the modest 900 IP nodes...But I digress.
Fun for some, but painfull for others: It would embarrass a
lot of hosts, because it would show how bad their segments
are maintained in the nodelist...
wilfred@wilnux5:~/tmp> gpg --verify aug.msg
gpg: Signature made do 02 jan 2020 01:27:05 CET using RSA key ID 5789589B
gpg: Can't check signature: No public key
The following should be the right key for ID 5789589B
- -----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBF4NOFYBCADa6gPUjpNmqWt5V5JehfGduti7TXWtfijFPrxYudCE1jleIlUw
vThPsd6pX3o2KR/JkZEHpP9e1tkoUwNdOPUe1+OSkQAnr4BGbquMqE5Y79keRvAE
one... on this message. So you are using a revoked key!?
Interesting.. Why is GPG using the revoked one, when there is a working
available... Hmm...
I don't know. Maybe it's the default? (Can you set a default key?)
This one had a valid signature from a valid key.
I just signed the key of August. :)
And where is it? If it's only in your keyring, it's not very usefull
for the rest of the world, that you signed it. ;)
It should have been uploaded to the keyserver.
Of course! Got it... ;)
And in fidonet some systems wouldn't allow encrypted routed
netmail messages to pass their systems... I remember there
was a lot of discussion going on about that at the time.
Yes, there was a lot discussion in finnish echos too.
,U,ENC. :)
How is that supposed to be interpreted?… The nodelist just says "node
accepts inbound encrypted mail".… And, is encrypted mail only supported *between* nodes that _both_ have ENC specified?
The following should be the right key for ID 5789589B
I am going to have to scrap the key for ID 5789589B above. I did
not realize that the email address that I needed to configure in
OpenPGP should not be padded like I had it done
as "august@R_E_M_O_V_Ekolico.ca"
If my original key has either expired or is no longer compatible with
the newer PGP since then, that is probably a good thing.
There is another one that I first mentioned in FUTURE4FIDO in April:
https://fido.net.wisc.edu/
The following should be the right key for ID 5789589B
I am going to have to scrap the key for ID 5789589B above. I did not realize that the email address that I needed to configure in OpenPGP should not be padded like I had it done as
"august@R_E_M_O_V_Ekolico.ca"
It's not necessary to "scrap" a key, just because the "uid"
(user ID) is no longer relevant.
You can add additional (new) uid's, you can delete uid's (but
that won't remove them from keys on keyservers), and you can
revoke uid's.
For instance my 9611AC4F key (which is on the keyservers), has
3 active uid's (with current email addresses), and 3 revoked
uid's (with email address I no longer use)...
Btw: I'm using 'gpg' (2), which I think is more or less the
standard software on linux to do (open)pgp stuff with.
https://fido.net.wisc.edu/
What is that supposed to show? It seems like a bunch of
random "info" to me...
I don't know. Maybe it's the default? (Can you set a default key?)
In Golded setup I could use the exact fingerprint to choose the key instead of using the email address. "gpg.exe -o @file -u "tommi@fidonet.fi" --clearsign @tmpfile" apparently picked up the first one in the ring. The revoked one.
This one had a valid signature from a valid key.
Good.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
insteadI don't know. Maybe it's the default? (Can you set a default key?)
In Golded setup I could use the exact fingerprint to choose the key
of using the email address. "gpg.exe -o @file -u "tommi@fidonet.fi" --clearsign @tmpfile" apparently picked up the first one in the ring. The revoked one.
It's not necessary to "scrap" a key, just because the "uid"
(user ID) is no longer relevant.
You can add additional (new) uid's, you can delete uid's (but
that won't remove them from keys on keyservers), and you can
revoke uid's.
I am not sure I can tie a proper (non-padded) email address to the one I messed up with the program I am using.
I'm pretty new to the process. I have to figure out the right rhythm
and steps.
If you were to create an email to me using my current key, would you
have to remove the R_E_M_O_V_E part manually each and every time?
For instance my 9611AC4F key (which is on the keyservers), has
3 active uid's (with current email addresses), and 3 revoked
uid's (with email address I no longer use)...
Yes, I pulled that one down. It has 5 "Also known as" email addresses.
Key management could be a nightmare across multiple devices.
It's pretty neat that I can look up old friends and check the
properties of the keys.
Checking if my golded signing configuration works... ;)
-----BEGIN PGP SIGNED MESSAGE----- TK> Hash: SHA256
I'm wondering why yours uses SHA256 and mine uses SHA1. SHA1 is the
more compatibel one with older versions, but is less secure...
Just found the --default-key option. ;)
I have this in my ~/.gnupg/gpg.conf file:
Key management could be a nightmare across multiple devices.
Btw: I'm using 'gpg' (2), which I think is more or less the
standard software on linux to do (open)pgp stuff with.
It is a very smart inclusion in linux. But I'll stick with a Windows offering. The Enigmail version, as an Add-On for Thunderbird, seems
to be a smooth integration. The only thing I can't seem to check is
which PGP version my Enigmail/GnuPG-generated key is using. But the
linux tool can do that.
Checking if my golded signing configuration works... ;)
Works ok! However, using Thunderbird as a fidonet client does not show your from: name as it should. But it works. ;)
-----BEGIN PGP SIGNED MESSAGE----- TK> Hash: SHA256
I'm wondering why yours uses SHA256 and mine uses SHA1. SHA1 is the
more compatibel one with older versions, but is less secure...
Hmm.. No idea..
Key management could be a nightmare across multiple devices.
I export my secret keys to a "home" directory in my LAN, and
then I can import them to any workstation.
Enigmail is a nice tool, as well as kleopatra of gpg4win
package.
Hi Tommi,
On 2020-01-04 22:22:45, you wrote to me:
-----BEGIN PGP SIGNED MESSAGE----- TK> Hash: SHA256
I'm wondering why yours uses SHA256 and mine uses SHA1. SHA1 is the
more compatibel one with older versions, but is less secure...
Hmm.. No idea..
You don't have anything in you gpg.conf ?
Maybe thunderbird forces it?
I'll sign this one with Golded.
'Tommi
I'll sign this one with Golded.
'Tommi
Hi Tommi, Enigmail is reporting the following for your previous message:
Enigmail Security Info Part of the message signed Unverified signature
Public key D22932992A6F822A used to verify signature BAD signature
from Tommi Koivula <tommi@fidonet.fi>
Why would it be BAD?
Enigmail Security Info Part of the message signed Unverified signature
Public key D22932992A6F822A used to verify signature BAD signature
from Tommi Koivula <tommi@fidonet.fi>
Why would it be BAD?
I'm not sure but it may be because of the way how JamNNTPd shows the
From: field.
Enigmail Security Info Part of the message signed Unverified signature
Public key D22932992A6F822A used to verify signature BAD signature
from Tommi Koivula <tommi@fidonet.fi>
Why would it be BAD?
I'm not sure but it may be because of the way how JamNNTPd shows the
From: field.
Meanwhile, I found a PGP app for my Blackberry. Getting the secret
keys to it in a secure way are a bit tricky though.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
You don't have anything in you gpg.conf ?
Nope. Maybe it is how the key was initially created?
Maybe thunderbird forces it?
I don't think so...
I'll sign this one with Golded.
I'll sign this one with Golded.
'Tommi
Hi Tommi, Enigmail is reporting the following for your previous message:
Enigmail Security Info Part of the message signed Unverified signature Public key D22932992A6F822A used to verify signature BAD signature
from Tommi Koivula <tommi@fidonet.fi>
Why would it be BAD?
isI'll sign this one with Golded.
Still SHA256. It might have to do with the gpg version you are using. Mine
somewhat older:
# gpg --version
gpg (GnuPG) 2.0.24
libgcrypt 1.6.1
...
Maybe the default hash algorithme has change in newer versions?
gpg --version
I am not sure I can tie a proper (non-padded) email address
to the one I messed up with the program I am using.
What program are you using?
And you should be able to! ;)
If you were to create an email to me using my current key,
would you have to remove the R_E_M_O_V_E part manually each
and every time?
I have no clue, I have never tried sending an encrypted
email. ;)
It's pretty neat that I can look up old friends and check
the properties of the keys.
Indeed. ;)
But are those older keys still usable? I have two keys from
1993, I no longer remember the passwords for. :-( But they
aren't on the keyservers afaik, so nobody will be tempted
to use them. ;)
You could for instance add: https://www.gpg4win.org/ to
your Windows setup, so you have a decent key management tool...
Good to know it works. (But I won't be signing every
message by default ;))
Meanwhile, I found a PGP app for my Blackberry. Getting the
secret keys to it in a secure way are a bit tricky though.
If you used decent passwords for the secret keys, it
doesn't matter if the files fall in the wrong hands...
Enigmail Security Info Part of the message signed Unverified signature Public key D22932992A6F822A used to verify signature BAD signature
from Tommi Koivula <tommi@fidonet.fi>
Why would it be BAD?
I'm getting a good signature on Tommy's message:
gpg: Signature made za 04 jan 2020 22:10:34 CET using RSA key ID 2A6F822A gpg: Good signature from "Tommi Koivula <tommi@rbb.fidonet.fi>" [unknown] gpg: aka "Tommi Koivula <tommi@fidonet.fi>" [unknown]
gpg: aka "Tommi Koivula <tommi@rbb.bbs.fi>" [unknown]
gpg: aka "Tommi Koivula <tommi.koivula@p1.f1.n221.z2.fidonet.fi>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 4132 67AD A3AC 401A 18C0 23D2 D229 3299 2A6F 822A
There is no nodelist flag that tells NOT to accept encrypted mail.
So my node will accept encrypted mail and will forward it but you
cannot know how the next hop treats it.
Please test. :D
Meanhile, email is probably a more reliable option for really
private messaging anyway.
Maybe the default hash algorithme has change in newer versions?
Perhaps.. In this Windows I'm using :
Tuetut algoritmit:
JulkAvain: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Salaus: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Tiiviste: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Pakkaus: pakkaamaton, ZIP, ZLIB, BZIP2
PS. I hate when programs speak finnish, even if I have an english
OS... :)
The message I am replying to in this message gave me this report:
Error - signature verification failed
gpg command line and output:
C:\Program Files\gnupg\bin\gpg.exe
gpg: Signature made 01/04/20 12:47:07 Eastern Standard Time
gpg: using RSA key 3BB37DA84A97932B
gpg: BAD signature from "Wilfred van Velzen <wvvelzen@gmail.com>" [unknown]
It's the one you wrote to Tommi with:
Apparently, I haven't fully explored its full configuration options.
There are so many. I saw a setting on my other pc where I could
"assign" other identities to the existing ones. Maybe that is the
answer.
Next to being able to sign messages in echomail/newsgroups, fully encrypted messages only make sense in email - direct to a specific individual.
But are those older keys still usable? I have two keys from
1993, I no longer remember the passwords for. :-( But they
aren't on the keyservers afaik, so nobody will be tempted
to use them. ;)
That's the beauty of pulling down the keys and checking their
properties. The properties will reveal creation dates, expiry dates, revocations,etc. It would be relatively easy to just pick the most
recent date, and send a brief hello message with a CC: and see which
ones reach their target.
Good to know it works. (But I won't be signing every
message by default ;))
Signing probably makes most sense for official content that contains specific data, dates, to register an official vote, etc.
The technology was probably only intended to be used in direct 1 to 1 exchanges like email.
Sometimes I get requests from vendors via email that require a confirmation for a particular agreement. There is a document that they request be signed. In the not too distant past, I would print the doc, add my signature, scan it, print it and fax it. Very time consuming.
When the fax device died (pc usb type), I would take a pictures of the signed doc, copy the pic to the network and email the pic.
Since then, I've learned to sign the pdf version of the doc and email it back.
But a pgp signature would be even simpler and faster.
If you used decent passwords for the secret keys, it
doesn't matter if the files fall in the wrong hands...
I could email the secret keys between my devices, but I don't like the idea that email in general is in the clear and the isp/systems enroute
can cache and record anything.
The passphrase is fairly decent. I am confident that no one would be
able to guess it.
Enigmail Security Info Part of the message signed Unverifiedsignature
Public key D22932992A6F822A used to verify signature BAD signature
from Tommi Koivula <tommi@fidonet.fi>
Why would it be BAD?
I'm getting a good signature on Tommy's message:
gpg: Signature made za 04 jan 2020 22:10:34 CET using RSA key ID 2A6F822A
gpg: Good signature from "Tommi Koivula <tommi@rbb.fidonet.fi>" [unknown]
gpg: aka "Tommi Koivula <tommi@fidonet.fi>" [unknown]
gpg: aka "Tommi Koivula <tommi@rbb.bbs.fi>" [unknown]
gpg: aka "Tommi Koivula
<tommi.koivula@p1.f1.n221.z2.fidonet.fi>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 4132 67AD A3AC 401A 18C0 23D2 D229 3299 2A6F
822A
I think it has to do with whether he is using GoldED or Thunderbird.
My keys with his ID 2A6F822A do not have the long
p1.f1.n221.z2.fidonet.fi address in the list. And my Enigmail reports a different fingerprint.
Further, since there is no way for a user to know in advance how one
U,ENC system routes their mail, and since there is no guarante what happens if a packet reaches a non-U,ENC system, there is no point in taking chances and causing annoyance. :(
I could email the secret keys between my devices, but I don't like the
idea that email in general is in the clear and the isp/systems enroute
can cache and record anything.
Re: Key management could be a nightmare
By: August Abolins to Wilfred van Velzen on Sun Jan 05 2020 03:21:24
I could email the secret keys between my devices, but I don't like
the idea that email in general is in the clear and the isp/systems
enroute can cache and record anything.
use pgp/gpg to encrypt it, then email it, and decrypt it on the other
end...
As long as you dont use Gmail. ;)
Error - signature verification failed
gpg command line and output: C: \Program
Files\gnupg\bin\gpg.exe gpg: Signature made 01/04/20
12:47:07 Eastern Standard Time gpg: using RSA key
3BB37DA84A97932B gpg: BAD signature from "Wilfred van
Velzen <wvvelzen@gmail.com>" [unknown]
It's the one you wrote to Tommi with:
So you don't have the key I used there?
Next to being able to sign messages in echomail/newsgroups,
fully encrypted messages only make sense in email - direct
to a specific individual.
Or routed netmail!
That's the beauty of pulling down the keys and checking
their properties. The properties will reveal creation
dates, expiry dates, revocations, etc. It would be
relatively easy to just pick the most recent date, and send
a brief hello message with a CC: and see which ones reach
their target.
If there are multiple keys to choose from...
Good to know it works. (But I won't be signing every
message by default ;))
Signing probably makes most sense for official content that
contains specific data, dates, to register an official
vote, etc.
Yes, it doesn't add too much in the mostly casual
communication that goes on in fidonet...
Since then, I've learned to sign the pdf version of the doc
and email it back.
But a pgp signature would be even simpler and faster.
If they can verify the signature is really made by who you
claim you are! It would be even better, because it's easier
to create a false hand written signature.
I could email the secret keys between my devices, but I
don't like the idea that email in general is in the clear
and the isp/systems enroute can cache and record anything.
You can use a common storage place, either on your own
network or external lile dropbox. If that's an encrypted
place (I don't know if dropbox is by default?) that would
be even better.
The passphrase is fairly decent. I am confident that no one
would be able to guess it.
Than it doesn't matter too much what you use to exchange
the secret key files.
My keys with his ID 2A6F822A do not have the long
p1.f1.n221.z2.fidonet.fi address in the list. And my
Enigmail reports a different fingerprint.
Then you should update the key from a keyserver...
gpg command line and output: C: \Program
Files\gnupg\bin\gpg.exe gpg: Signature made 01/04/20
12:47:07 Eastern Standard Time gpg: using RSA key
3BB37DA84A97932B gpg: BAD signature from "Wilfred van
Velzen <wvvelzen@gmail.com>" [unknown]
It's the one you wrote to Tommi with:
So you don't have the key I used there?
Hello Wilfred,
Send me the fingerprint of the keys I should be using, and I'll grab
them from a server.
BTW, is it this one:
keys.openpgp.org
https://keys.openpgp.org/vks/v1/by-fingerprint/D50ECD4F514B75DC0A064F893BB3
7DA84A97932B
Next to being able to sign messages in echomail/newsgroups,
fully encrypted messages only make sense in email - direct
to a specific individual.
Or routed netmail!
But we really don't know the exact route a netmail will take.
For a user, unless they analyze the nodelist or confirm things with
their sysop, netmail is unreliable.
I also use point-software (OpenXP) which allows sending crash mail.
With that, I could crash my encrypted netmail to its final destination with confidence to any system that flies the U,ENC flags.
I haven't seen PGP signing used very much in the echos (or at least
not in the few and active ones that I read). Where else do you see it used?
But a pgp signature would be even simpler and faster.
If they can verify the signature is really made by who you
claim you are! It would be even better, because it's easier
to create a false hand written signature.
I don't think they would lack any confidence in an email that they use
to send me reminders of an overdue invoice, with my ACK. <G> And..
many vendors keep a record of email addys after a phone call with me giving them a specific addy.
Yep. PGP signing would be a very convenient solution for signing agreements with on-sale dates that I have to acknowledge.
If they can verify the signature is really made by who you
claim you are! It would be even better, because it's easier to
create a false hand written signature.
use pgp/gpg to encrypt it, then email it, and decrypt it on the other
end...
Still working through the morning coffee? <BWG>
I need that key on the other end *before* I can decrypt anything.
gpg command line and output: C: \Program
Files\gnupg\bin\gpg.exe gpg: Signature made 01/04/20 12:47:07
Eastern Standard Time gpg: using RSA key 3BB37DA84A97932B
gpg: BAD signature from "Wilfred van Velzen
<wvvelzen@gmail.com>" [unknown]
BTW, is it this one:
keys.openpgp.org
https://keys.openpgp.org/vks/v1/by-fingerprint/D50ECD4F514B75DC0A064F893BB3
7DA84A97932B
Yes that looks like it. The ID that's quoted above is enough to
search for it!
wilfred@wilnux5: ~> gpg -- fingerprint - k 4A97932B pub
4096R/4A97932B 2017-10-25 [expires: 2023-01-01] Key
fingerprint = D50E CD4F 514B 75DC 0A06 4F89 3BB3 7DA8 4A97 932B
uid [ultimate] Wilfred van Velzen <wvvelzen@gmail.com> uid
[ultimate] Wilfred van Velzen <wilfred@vvlzn.nl> uid [ultimate]
[jpeg image of size 5943] sub 4096R/2D3482F3 2017-10-25
I haven't seen PGP signing used very much in the echos (or at
least not in the few and active ones that I read). Where else
do you see it used?
Well lately I've seen it in this area and FIDOTEST.
Outside of fidonet. I see it sometimes in newsgroups. And I
know the (open)suse, software distribution system makes use of
gpg keys to sign the distributed software.
Yep. PGP signing would be a very convenient solution for
signing agreements with on-sale dates that I have to
acknowledge.
I don't think "they" are going to trust it, untill there will
be a government key signing authority, that can "properly"
verify your identity.
For a user, unless they analyze the nodelist or confirm things
with their sysop, netmail is unreliable.
Indeed. But I doubt many systems still filter-out/bounce
netmail with encrypted content.
And in case of a point as destination of which the boss has the
ENC flag. You can crash the encrypted netmail at the boss's
system...
Still working through the morning coffee? <BWG>
nope, not when i wrote that...
I need that key on the other end *before* I can decrypt
anything.
are you saying that you cannot simply encrypt some text and
decrypt it? i don't mean to encrypt it to a specific
individual... just general encryption with a phrase... pgp used
to do that and i used it numerous times to send stuff to others
with no keys involved...
https://keys.openpgp.org/vks/v1/by-fingerprint/D50ECD4F514B75DC0A064F8 93BB37DA84A97932B
Yes that looks like it. The ID that's quoted above is enough to
search for it!
I found out that is not always the case. It seems to depend on the
server. For example, I used your RSA key 3BB37DA84A97932B as above, but the server at keys.openpgp.org reported that they do not support abbreviated keys.
wilfred@wilnux5: ~> gpg -- fingerprint - k 4A97932B pub
4096R/4A97932B 2017-10-25 [expires: 2023-01-01] Key
fingerprint = D50E CD4F 514B 75DC 0A06 4F89 3BB3 7DA8 4A97 932B
uid [ultimate] Wilfred van Velzen <wvvelzen@gmail.com> uid
[ultimate] Wilfred van Velzen <wilfred@vvlzn.nl> uid [ultimate]
[jpeg image of size 5943] sub 4096R/2D3482F3 2017-10-25
What is interesting, I just fetched your updated keys from the *same* server that I used on my lessor TB 2.0.0.24 pc, but this time on my TB
60 there was no photo offered or recorded. :(
I wonder why the difference.
Outside of fidonet. I see it sometimes in newsgroups. And I
know the (open)suse, software distribution system makes use of
gpg keys to sign the distributed software.
According to the info at https://sks-keyservers.net/status/
Max keys: 5964828
That's really not a whole lot in the internet collective.
me.I don't think "they" are going to trust it, untill there will
be a government key signing authority, that can "properly"
verify your identity.
Why not? There is a vast pre-history of email exchange between me and
the vendor with many emails that include my customer/account number with them. And my cheques even include the same customer/account number. So, they ought have great confidence that next time they send me something
to the same email address to sign, then my PGP-signed reply was done by
For a user, unless they analyze the nodelist or confirm things
with their sysop, netmail is unreliable.
Indeed. But I doubt many systems still filter-out/bounce
netmail with encrypted content.
Now that you let the cat out of the bag, so to speak.. sysops may be interested to add such filters to find out! LOL
Enigmail is a nice tool, as well as kleopatra of gpg4win package.
I found out that is not always the case. It seems to depend on
the server. For example, I used your RSA key 3BB37DA84A97932B
as above, but the server at keys.openpgp.org reported that they
do not support abbreviated keys.
Strange. Why wouldn't they support it? What would be the
benefit of that?
When I export the key to the server, I have the option not to
export attributes (photo ID). Maybe it's optional on importing
to, but the option isn't given to you?
According to the info at https://sks-keyservers.net/status/
Max keys: 5964828
That's really not a whole lot in the internet collective.
I wouldn't want to import them all to my keyring file!
............................. So, they ought have great
confidence that next time they send me something to the same
email address to sign, then my PGP-signed reply was done by me.
That requires some human employer to check this, and would make
the company responsible in case a human mistake was made. They
want that to be an external risk, not theirs...
Now that you let the cat out of the bag, so to speak.. sysops
may be interested to add such filters to find out! LOL
I don't think our audience is that big.
According to the info at https://sks-keyservers.net/status/
Max keys: 5964828
That's really not a whole lot in the internet collective.
I wouldn't want to import them all to my keyring file!
I was just pointing out that globally, there is a relatively small
number of people posting their keys.
That requires some human employer to check this, and would make
the company responsible in case a human mistake was made. They
want that to be an external risk, not theirs...
Maybe true re external risk. But if we are just talking about a
signature for a release-date acknowledgement, all "they" have to do is pull my public key to verify that the pgp-signed message with "I agree" was indeed penned by me.
Some aspects of business-2-business are ripe for pgp.
Now that you let the cat out of the bag, so to speak.. sysops
may be interested to add such filters to find out! LOL
I don't think our audience is that big.
Unless there are publicly disclosed traffic stats on netmail flowing through fidonet, we'll never quite know.
On the other hand. Almost every one with a key has more than 1. (Like Tommy's18 ;))
You could do some tests, sending encrypted and non-encrypted routedI may need to set up my Golded to send encrypted netmail, Thunderbird does not allow encrypted mail to "news" netmail...
netmails through the net. But you will have to find volunteer
destinations in all far away corners of the nodelist. ;)
insteadOn the other hand. Almost every one with a key has more than 1. (Like
Tommy's 18 ;))
Yeah, I didn't understand the whole shit once. And created new keys
of adding into one. ;)
You could do some tests, sending encrypted and non-
encrypted routed netmails through the net. But you will
have to find volunteer destinations in all far away corners
of the nodelist. ;)
On the other hand. Almost every one with a key has more than 1. (Like
Tommy's 18 ;))
Yeah, I didn't understand the whole shit once. And created new keys
instead of adding into one. ;)
Maybe you should revoke a bunch, so it's clear to people what the
prefered one is? ;)
Yeah, I didn't understand the whole shit once. And created new keys
instead of adding into one. ;)
Max keys: 5964828
That's really not a whole lot in the internet collective.
I think almost 6 million isn't a small number. Almost 1 in every 1000
earth human has one. ;)
On the other hand. Almost every one with a key has more than 1. (Like
Tommy's 18 ;))
Some aspects of business-2-business are ripe for pgp.
You don't have to convince me. ;)
I may need to set up my Golded to send encrypted netmail,
Thunderbird does not allow encrypted mail to "news"
netmail...
I posted two test replies in the pkey_drop. One to Wilfred, and one
to you.
You could do some tests, sending encrypted and non-
encrypted routed netmails through the net. But you will
have to find volunteer destinations in all far away corners
of the nodelist. ;)
For starters, the ENC flag seems to be flown in Z2 systems only.
So, it is unlikely that anyone in Z1 would like to participate.
But it could be interesting which non-ENC systems let the messages
pass through.
Nah.. best to stick with known systems that show ENC.
Maybe you should revoke a bunch, so it's clear to people what the
prefered one is? ;)
Or.. just keep a couple.
I only have 2 of Tommi's: 0e6b3c81 and 2a6f822a
The former has 2 added email akas, and the latter has 3.
Those seemed to be the most recent ones anyway.
I think almost 6 million isn't a small number. Almost 1 in every
1000 earth human has one. ;)
On the other hand. Almost every one with a key has more than 1. (Like
Tommy's 18 ;))
Right, so that reduces the estimate a bit. And if you factor in the keys that are expired or revoked, the number may be significantly less.
Some aspects of business-2-business are ripe for pgp.
You don't have to convince me. ;)
I'v read about S/MIME type encryption methods that use certificates. And these certificates are created and registered with an "authority". When I was looking for something to use with MS Outlook for business, I only came across solutions that required payment.
Maybe big-business environments use the above solution.
But PGP management is much simpler and gives total angency to the
user.
I am a little surprised pgp is not more ubiquitous as it *should* be.
What type of business is/was your involvement?
I only have 2 of Tommi's: 0e6b3c81 and 2a6f822a
The former has 2 added email akas, and the latter has 3.
Those seemed to be the most recent ones anyway.
Tommi should resolve the mystery, which keys are the prefered ones! ;)
Tommi should resolve the mystery, which keys are the prefered ones!
;)
In email, it should be clear.
In fidonet, it really doesn't matter. ;)
aren't revoked orTommi should resolve the mystery, which keys are the prefered ones!
;)
In email, it should be clear.
Not for every email adres. Some have multiple corresponding keys, which
expired.
In fidonet, it really doesn't matter. ;)
I've used the ones with "fido" in them... ;)
I posted two test replies in the pkey_drop. One to Wilfred, and
one to you.
I posted two test replies in the pkey_drop. One to Wilfred, and one
to you.
The one to me was encrypted only for youself. Very secret. :)
In email, it should be clear.
Not for every email adres. Some have multiple corresponding keys,
which aren't revoked or expired.
Yes. Just revoked something...
Noticed... But there are still duplicate email addresses, on 2 pairs ofkeys:
Noticed... But there are still duplicate email addresses, on 2 pairs
of keys:
There should not be duplicates anymore. Maybe you were too fast and those changes were not in keyservers yet?
-----BEGIN PGP MESSAGE-----
hQIMAzrAVz4tNILzAQ//eA3UNU/Qiv+nAoPTlm4ZeKhDgp2vuGykfUocpmPHkNKL Lmq85Km2z+daCyQ7pl44zhhTNkcqvB8Tm0vwkpnriW3mW8N/2EU58lgH5O+oQOcH 2CbxAx8nh1WD1FFA97vby/T9GrOkFnPoB+Aqorj1IKCabR2bjmcYgQydNplg8Y/S qO1H2loHIOWD22xCdKsFZ0b0IPcNVkf7A5RysO626CjDIb06ALOnXAylcuP5fSHW YZKv06oCICOY5W8n3UzScEmsErXq/VxshfHwWOrLOWSqIu/68zvVVgKeBwwV/dF8 e3+XM7tfQ//oPpLhLIqvuyiY99sS8XC5oi/wZhMiL9ScNBGYBEfUFf6Jp3DokMFs uCiaS04w79kGKXsu5KaWEe3NRrq8W/bQ0rXeL9LNGaCXE5zE84YT+eD8K5ml0Y7i M8pydNYNlJucGmVCULcZZj4wRoGBHIJGnIo1zrGhKGSj5rLf2bUkz8/hjwWNmUx+ rfhVUcqZxAlOgaFt2P7uD1uk5ZlK5IhnAvxtJWCuxbTqYJ8rQI3m3j6n+VeZVMD9 6JoZ2uMBFXiPfQK+igsOldNC+ap1qStckEjoEm4m/t96DFNB4DWomvVM0wDqIo8+ Xtploc7vfx5OwpxM49InBrl0POjYy4mKOodpKU71T+VAIs8AbC2dksmaYF9uaxPS wNgBIwVxZhbuxhCjWOi8y9yfha891VxB4GR/0JNVqCARk2dJaQHHBZ46wNXhVhAT MCjUZ/4w6T2cfk3m+q82Pq+t/EWPRsBiz/hMe3/Lul721i6RwUavtJW7719SPI0M oEnIUZPyKiH6XYvvdhIP76m7naN4r5zn3/FJZpaNbZT6b+QPESg6qTEMAvUm4ZIQ 716UFSogxIdSeHEpQk0KavAQgCSei1IF7lBW01MSNcoh6rfHM8i3EoqpheQlvj94 /pyc/v/1fNVLxcS7iEa//+p32ppkskha6BmFvLmBGR4SGkPwJhD47MU81+UDItXw emUv9rAtBPYkEEoUlUhn/z+hOWDjtO9G7GEBCCS2m5N22Q7cUGecU4ojsmhVIgli 0DqX7qL/XxpPpa/5OG0fj5hvYiWOF6I2jcgesTPk/jrfLIumUZOm6/CzJwkh/RjR SzCd1GRQkOoLhjnZkvTp+agGqmhoEAUiFSTkNLLCV5CHYFFs7CvK9el1ZFceMQH1 vOdM/PEDm209TmyzeBTRsj3H1AVDnbnsRqw=
=+FBq
-----END PGP MESSAGE-----
 TK> -----BEGIN PGP MESSAGE-----[snip - much super secret content removed]
 TK> hQIMAzrAVz4tNILzAQ//eA3UNU/Qiv+nAoPTlm4ZeKhDgp2vuGykfUocpmPHkNKL
 TK> Lmq85Km2z+daCyQ7pl44zhhTNkcqvB8Tm0vwkpnriW3mW8N/2EU58lgH5O+oQOcH
 TK> SzCd1GRQkOoLhjnZkvTp+agGqmhoEAUiFSTkNLLCV5CHYFFs7CvK9el1ZFceMQH1
 TK> vOdM/PEDm209TmyzeBTRsj3H1AVDnbnsRqw=
 TK> =+FBq
 TK> -----END PGP MESSAGE-----
That was a really exiting message! ;)
Decoding and verifying went well:
wilfred@wilnux5:~> gpg tommi.msg
You need a passphrase to unlock the secret key for
user: "Wilfred van Velzen <wvvelzen@gmail.com>"
4096-bit RSA key, ID 2D3482F3, created 2017-10-25 (main key ID 4A97932B)
Decoding and verifying went well:
wilfred@wilnux5:~> gpg tommi.msg
You need a passphrase to unlock the secret key for
user: "Wilfred van Velzen <wvvelzen@gmail.com>"
4096-bit RSA key, ID 2D3482F3, created 2017-10-25 (main key ID 4A97932B)
Ahh.. so you are saving the block (pulling it out of your echomail reader) to file tommi.msg manually, and then running gpg in a separate window/session.
The process is much smoother with TB and processed within the same
reading environment/application. :)
I guess you could accomplish something similar using macros/scripts with your GoldED?
I posted two test replies in the pkey_drop. One to Wilfred, and
one to you.
please remember that PKEY_DROP is only for posting public keys...
..AFAIK, this is the only echo that allows such ;)
I actually just discovered I already had such a macro in my golded.cfg, I
just had to assign a key to it, to actually be able to use it. ;)
The only drawback is, I can't see the output of the decoding/verifying
proces, so I don't know if the encrypted message was signed with a
trusted key, or even not signed at all. It's probably just a matter of
adding a "press any key to continu" option to the end of the decoding
script, to make that possible. That would also work on clearsigned
messages.
The only drawback is, I can't see the output of the
decoding/verifying proces, so I don't know if the encrypted message
was signed with a trusted key, or even not signed at all. It's
probably just a matter of adding a "press any key to continu" option
to the end of the decoding script, to make that possible. That would
also work on clearsigned messages.
Can you modify the macro to include the auto-signing. Gpg will pick the key that you have previously assigned as your primary key
already have/hadCan you modify the macro to include the auto-signing. Gpg will pick the
key that you have previously assigned as your primary key
We were talking about decrypting. Signing you do with encrypting. I
macros in place for that in golded. They are presented to me as options inthe menu
when I save the message I just entered...
EXTERNUTIL 2 gpg.exe --default-key 2A6F822A -o @file --clearsign
@tmpfile
EDITSAVEUTIL 2 "gpg sign the msg --default-key 2A6F822A"
EXTERNUTIL 3 gpg.exe --default-key 2A6F822A -sea -o @file -r "@dname" @tmpfile EDITSAVEUTIL 3 "gpg encrypt the msg --default-key 2A6F822A"
=== Cut ===
My Golded.cfg in Windows.
We were talking about decrypting. Signing you do with
encrypting. I already have/had macros in place for that in
golded. They are presented to me as options in the menu when I
save the message I just entered...
EXTERNUTIL 1 /home/fido/bin/fido_gpg.sh @file-sa                      Â
             ;sign
Hi August,
On 2020-01-09 22:37:05, you wrote to me:
EXTERNUTIL 1 /home/fido/bin/fido_gpg.sh @file -sa ;sign
Stupid question. Why would you just sign a message without the-e for AA> encryption?
I was thinking the same thing. ;-)
Let's try it out on this reply.
Below is my reply to your message. It's not encrypted only signed (but
not clearsigned). Anyone with gpg can decode it and view it's contents.
If they have my public key they can verify it was me who wrote it. Why
you would want to do it this way, I don't know. I can't think of a
use-case for it...
-e for AA> encryption?EXTERNUTIL 1 /home/fido/bin/fido_gpg.sh @file -sa ;sign
Stupid question. Why would you just sign a message without the
I was thinking the same thing. ;-)
Let's try it out on this reply.
OK.. I received it with the usual PGP BLOCK header, and all the gibberish, so it *is* encrypted?
But the difference would be that anyone who has my or your public key
can read it?
Below is my reply to your message. It's not encrypted only signed (but
not clearsigned). Anyone with gpg can decode it and view it's contents.
If they have my public key they can verify it was me who wrote it. Why
you would want to do it this way, I don't know. I can't think of a
use-case for it...
TB decrypted it automatically, (but it obscured your preface above; the decryption result in TB fills the whole reading window of the open message).
It contained this security header info:
Part of the message signed Good signature from Wilfred van Velzen <wvvelzen@gmail.com> Key ID: 0xD50ECD4F514B75DC0A064F893BB37DA84A97932B
/ Signed on: 01/09/20, 3:58 PM Key fingerprint: D50E CD4F 514B 75DC 0A06 4F89 3BB3 7DA8 4A97 932B Used Algorithms: RSA and SHA-1
I assume that it can then be read by anyone who has the key of the
author. ?
If so, then a good practical use would be if you wanted a totally
obscured message stream by adding an extra layer of frustration to just anyone, or even from the bots that skim messages. ? I kinda like that.
It would force the would-be reader to collect the keys of everyone who
is writing the messages, but still remain a lurker. ?
Not good good for sharing sensitive info though.
Further to your preceding message, you sent it signed with SHA1.
In the real world outside of fidonet it might be wise never to use that:
https://www.pcworld.com/article/3173791/stop-using-sha1-it-s-now-completel y -unsafe.html
Below is my reply to your message. It's not encrypted
only signed (but not clearsigned). Anyone with gpg can
decode it and view it's contents. If they have my public
key they can verify it was me who wrote it. Why you would
want to do it this way, I don't know. I can't think of a
use-case for it...
TB decrypted it automatically, (but it obscured your
preface above; the decryption result in TB fills the whole
reading window of the open message).
I get the same thing when I decode a message with mixed
content from within golded. It's to be expected. But golded
doesn't decode unless told to, so I always see the mixed
content first...
Further to your preceding message, you sent it signed with
SHA1.
Yeah, I already thought so. It's the default in my older
gpg version. Let me try and change that...
Below is my reply to your message. It's not encrypted
only signed (but not clearsigned). Anyone with gpg can
decode it and view it's contents. If they have my public
key they can verify it was me who wrote it. Why you would
want to do it this way, I don't know. I can't think of a
use-case for it...
I will believe that when I get an -s signed message from someone for
whom I do not have a key. Maybe mark will oblige, as I do not have his key.
EXTERNUTIL 1 /home/fido/bin/fido_gpg.sh @file -sa ;sign
Stupid question. Why would you just sign a message without the -e for encryption?
[unknown]Further to your preceding message, you sent it signed with
SHA1.
Yeah, I already thought so. It's the default in my older
gpg version. Let me try and change that...
TB 2.0.0.24 warned me with this:
gpg command line and output:
C:\Program Files\gnupg\bin\gpg.exe
gpg: Signature made 01/09/20 17:20:12 Eastern Standard Time
gpg: using RSA key 3BB37DA84A97932B
gpg: BAD signature from "Wilfred van Velzen <wvvelzen@gmail.com>"
It is warning me that you are not the person who claims to have written that?
Maybe the new and old gpg programs are using different local key files
on your pc?
I tested it on another user account on my linux machine that
hasn't got yours or mine keys installed in it's gpg
configuration. I get:
------------------------------------
# gpg <signed.msg.txt
Btw: This is a good example when it's usefull to run gpg
without options!
TB 2.0.0.24 warned me with this:
gpg command line and output: C: \Program
Files\gnupg\bin\gpg.exe gpg: Signature made 01/09/20 17:20:12
Eastern Standard Time gpg: using RSA key 3BB37DA84A97932B gpg:
BAD signature from "Wilfred van Velzen <wvvelzen@gmail.com>"
[unknown]
I just tested the original text on my windows pc at work, and I
get:
gpg: WARNING: no command supplied. Trying to guess what you
mean... gpg: Signature made 01/09/20 23:20:12 W. Europe
Standard Time gpg: using RSA key 3BB37DA84A97932B gpg: Good
signature from "Wilfred van Velzen <wvvelzen@gmail.com>" [full]
gpg: aka "Wilfred van Velzen <wilfred@vvlzn.nl>" [unknown] gpg:
aka "[jpeg image of size 5943]" [unknown]
So...?
Maybe Tommi and/or Mark can try to verify it.
I tested it on another user account on my linux machine that
hasn't got yours or mine keys installed in it's gpg
configuration. I get:
------------------------------------
# gpg <signed.msg.txt
[snip]
Btw: This is a good example when it's usefull to run gpg
without options!
Very nice. Thanks for explaining and showing that.
I'll have to try that on a virgin pc with a fresh TB/Enigmail/gpg installation with no keys.
gpg: WARNING: no command supplied. Trying to guess what you
mean... gpg: Signature made 01/09/20 23:20:12 W. Europe
Standard Time gpg: using RSA key 3BB37DA84A97932B gpg: Good
signature from "Wilfred van Velzen <wvvelzen@gmail.com>" [full]
gpg: aka "Wilfred van Velzen <wilfred@vvlzn.nl>" [unknown] gpg:
aka "[jpeg image of size 5943]" [unknown]
So...?
Maybe Tommi and/or Mark can try to verify it.
According to the dates (and time), we have exactly the same version of your keys. So, if Tommi (or me) signed your key, and I refreshed your keys on my systems, then the error "BAD signature" message to me would
go away?
BAD signature sounds misleading. It's that you just don't have anyone
to have vouched for you yet?
According to the dates (and time), we have exactly the same
version of your keys. So, if Tommi (or me) signed your key,
and I refreshed your keys on my systems, then the
error "BAD signature" message to me would go away?
No. 'BAD signature' really means a bad signature!
According to the dates (and time), we have exactly the same
version of your keys. So, if Tommi (or me) signed your key,
and I refreshed your keys on my systems, then the
error "BAD signature" message to me would go away?
No. 'BAD signature' really means a bad signature!
What made it report BAD for me? It was exactly the same pub key pair between us. The exact time and date proved that.
What made it report BAD for me? It was exactly the same pub key
pair between us. The exact time and date proved that.
So if the keys weren't the problem. Something must have changed
in the plain text that was signed, before it reached you, that
made it fail the verify...
What made it report BAD for me? It was exactly the same pub key
pair between us. The exact time and date proved that.
So if the keys weren't the problem. Something must have changed
in the plain text that was signed, before it reached you, that
made it fail the verify...
So, when it says "BAD signature", it's talking about the signature of
the message?
Hmmm. A single char difference (maybe the odd =20 char) gets
introduced) and messes up the "signature" of the message.
I see that happening when I need to copy/paste the contents of a PGP
block and paste it into my BlackBerry's pgp decryptor window. It always seem to return an error and never decrypts.
encrypted and/or signed messsges are allowed in this echo...
AFAIK, this is the only echo that allows such
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 07/01/2020 8:10 a.m., mark lewis : August Abolins wrote:
encrypted and/or signed messsges are allowed in this echo...
AFAIK, this is the only echo that allows such
I recently updated my Win7 pc to TB 68 + the corresponding
Enigmail/GPG plugin.
But signed clear-text email seems to be rolling out with:
gpg command line and output:
C:\Program Files\gnupg\bin\gpg.exe
gpg: invalid armor header: Â \r\n
gpg: invalid armor header: Â \r\n
Signed clear-text messages from other people in this echo look good
and process properly.
So, I am testing one originating from this new TB68/Enigmail combo to
see if the "invalid armor header" is a problem here.
I'd hate to roll back TB. But maybe all I have to do is rollback the Enigmail plugin version?
- --
Quoted with Reformator/Quoter. Info = https://tinyurl.com/sxnhuxc -----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEE0OsqKVIE8xZ+slA87w6JZVeJWJsFAl4scOIACgkQ7w6JZVeJ WJugNQf/TcvM1zQJi8hN42CQDCtsTbX0hu2B/Smg3k/zy6aCB5FabIRGxgQCt3C0 yROmIvUpLLwQQ8MMwzYqQfvb25ifmt1NwCNHl2sPSQVeIUQPaU/6PNeikgSNhmXH w7SxK7upP17sAjIY3sG+lOto2S6HgDtt8MVyZrbr4BAUK6EfG475oTsKgo3jezTc ALa2W3tVByYS6TlnvuyqEFJkbShw6ddl+lIclYsK3A8B0y4S+rOLlklUyloUbVY1 u4BBpQAyWXzwLb9Mfm7W/X0pcCzlxCEtn4RXblMg9o7UnVNviYupc31HbLCAo/FO 61EYIA3M6lOe/QCfx6jk62qF+xFNLg==
=iByN
-----END PGP SIGNATURE-----
I recently updated my Win7 pc to TB 68 + the corresponding5789589B
Enigmail/GPG plugin.
But signed clear-text email seems to be rolling out with:
gpg command line and output:
C:\Program Files\gnupg\bin\gpg.exe
gpg: invalid armor header: Â \r\n
gpg: invalid armor header: Â \r\n
I'm getting:
gpg: Signature made za 25 jan 2020 17:46:26 CET using RSA key ID
gpg: BAD signature from "August Abolins <august@kolico.ca>" [unknown]
On this one...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Let's see how the signed clear-text behaves.
This signature was ok...
| Sysop: | altere |
|---|---|
| Location: | Houston, TX |
| Users: | 66 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 16:25:54 |
| Calls: | 728 |
| Files: | 7,667 |
| Messages: | 295,603 |