Clear sign message digest

[Nicolas Le Gland [e-mail] [PGP-Basics]]

Hello list.


I'm using GnuPG, and was wondering if there was a command line argument, or in another OpenPGP client, or a standalone tool out there, which would display the message digest corresponding to a document clear text signature.


According to http://tools.ietf.org/html/rfc4880#section-7 and following, clear text signature is performed over the CRLF dash-escaped sequence. In my case, such normalization helps with line ending conversion that might happen out of my control, when I still would like to extract that message digest.


Has anyone got any advise?
--
[Non-text portions of this message have been removed]




------------------------------------
Posted by: Nicolas Le Gland <***@legland.fr>
------------------------------------

______________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-***@yahoogroups.com
Gossamer Spider Web of Trust http://www.gswot.org

Yahoo Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/PGP-Basics/join
(Yahoo! ID required)

<*> To change settings via email:
PGP-Basics-***@yahoogroups.com
PGP-Basics-***@yahoogroups.com

<*> To unsubscribe from this group, send an email to:
PGP-Basics-***@yahoogroups.com

<*> Your use of Yahoo Groups is subject to:
https://info.yahoo.com/legal/us/yahoo/utos/terms/

[[e-mail] [PGP-Basics]]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Nicolas,

If I understand you correctly, you want to parse-out or extract the actual, say, sha512, message digest (or "hash") of the gpg-armored clearsigned text--specfically _after_ gpg has armored the original cleartext, correct? For example, presuming I've _already_ gpg-armored a file named "msg.txt", you would want the hexadecimal part of the output of this, correct?:
$ gpg --print-md SHA512 msg.txt
msg.txt: 1728B07E 4F7D4AA9 B4E5EFBC 19414A27 55F7E030 0643FC04 8DE6DC12 A3D9C64E
E0D6617B 274B6FFA 321EE8EE FE3DF36D 54EE3DDC 02B733C5 012B4370 49991421

The problem is, I think, that that message digest is encrypted with the signer's private key:
http://tools.ietf.org/html/rfc4880#section-2.2

That said, what you're looking for may be in the output of this:
$ gpg2 --debug-level 9 -vv --verify msg.txt.asc

This cleans up the above output a bit, but you'll need the above for context:
$ ( gpg2 --debug-level 9 -vv --verify msg.txt.asc 3>&1 1>&2 2>&3 | grep -v -e "gpg: DBG:" -e "^\(gpg\|DBG\):" ) 3>&1 1>&2 2>&3 | grep -e pkey: -e sig: -e hash:
(Credit to Paul Pomerleau at http://burgerbum.com/stderr_pipe.html for that "mess"!)

Search around in man gpg2 for terms like "digest" "packet" (maybe "subpacket") "debug", etc. Maybe a debug build of gpg2 might help.

This shows how the clearsign output is made up of well-structured and documented parsable packets and subpkts, one of which may contain what you want ("subpkt 16" or "data"?):
$ gpg -vv --verify msg.txt.asc
gpg: using character set `utf-8'
gpg: armor: BEGIN PGP SIGNED MESSAGE
gpg: armor header: Hash: SHA512
:packet 63: length 19 - gpg control packet
gpg: armor: BEGIN PGP SIGNATURE
gpg: armor header: Version: GnuPG v2.0.20 (GNU/Linux)
:literal data packet:
mode t (74), created 0, name="",
raw data: unknown length
gpg: original file name=''
:signature packet: algo 1, keyid xxx
version 4, created 1400768607, md5len 0, sigclass 0x01
digest algo 10, begin of digest 40 c7
hashed subpkt 2 len 4 (sig created 2014-05-22)
subpkt 16 len 8 (issuer key ID xxx)
data: [3199 bits]
gpg: Signature made Thu 22 May 2014 10:23:27 AM EDT using RSA key ID xxx
gpg: using PGP trust model
gpg: key xxx: accepted as trusted key
gpg: Good signature xxx ...
gpg: textmode signature, digest algorithm SHA512

These folks may help:
http://www.gnupg.org/documentation/mailing-lists.html
https://groups.yahoo.com/neo/groups/PGPNET/info

Maybe some relevant source code (grep for "proc_signature_packets" :
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=g10/packet.h
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=g10/sign.c

Unhelpful, but perhaps related:
https://security.stackexchange.com/questions/23348/parsing-a-pkcs7-detached-signature-hash
http://eco-forms.blogspot.com/2013/05/livecycle-designer-parsing-digital.html
https://stackoverflow.com/questions/6330329/getting-public-key-from-digital-signature

Let us know how we can help!

Good luck,
Pete
Fri 23 May 2014 08:57:30 AM EDT


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)

iQGsBAEBCgAGBQJTf0XiAAoJELOW7D0cI7Xw35QMgLUHU1D1jGTS7EOpSp66IEoT
ytjjlK6p7iU4CtGLQQ2lm/6SCtwBnTMPsxHIeAR+kkplZ66tgjRfoSPLPhOd0oBc
tOVk1v4r/p4c05371xWJlBaBxjauBDn+vhmbIambqE7/nZOj7jH5IuV4zY2qC3LQ
3M/ehHpCcjiureQ/n3QrAf7CD09LsLEjnsgzOrfXIWztZMU/sKu22ne4y1mHOY3M
tM/HR1HxxmdjXqkS+lqFN4/TyNuXqXJEixtFrhmMglyR9yv4TAObRv8pO4a6Np+G
hLIGRp6ImvWcZG96T6pRhkZoEt0iF0MEqQ37yjb51gzcUw6mFBU2u+wjafMgCaQq
cW8PrbcAHQJcW5BJBB4sC2EBZBm0luK4JG0rua84iOnEn8DhK95f0NK+op6TK5fb
4YN9MiKj/NePV8SfWTTHv6+lTWsFg492Yui+GWYNPZ4+Gt2PvfuBmQ+b3aZz5HRw
hjrhlYjPLc7VrUQLsOiB5LaqJaibwh2aF+GGK+8vF2GqSRT85rlHGn5FAHFGexs=
=ktnL
-----END PGP SIGNATURE-----


------------------------------------
Posted by: ***@tebuco.com
------------------------------------

______________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-***@yahoogroups.com
Gossamer Spider Web of Trust http://www.gswot.org

Yahoo Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/PGP-Basics/join
(Yahoo! ID required)

<*> To change settings via email:
PGP-Basics-***@yahoogroups.com
PGP-Basics-***@yahoogroups.com

<*> To unsubscribe from this group, send an email to:
PGP-Basics-***@yahoogroups.com

<*> Your use of Yahoo Groups is subject to:
https://info.yahoo.com/legal/us/yahoo/utos/terms/

[Nicolas Le Gland [e-mail] [PGP-Basics]]

Hello again and thanks for the insights. I did a few tests on my side, and think I should clarify what I was trying to achieve:

• Given a message digest and a plain-text document with unknown line endings, determine a match.

My initial try involved unix2dos piped with sha*sums. In the process I found myself looking for a way to generalize over and reuse OpenPGP, as an exercise:

1. Given a plain-text document and an ASCII-armored clear-signed document, both with unknown line ending control characters, determine if the former corresponds to the content of the later.

2. Given a plain-text document and a message digest algorithm, calculate the hash value in the same way an OpenPGP application would do for a clear-signature.

3. Extract the message digest from a clear-signed plain text document.

Thank you for the solution you provided me with for point 3. I did try using --debug-all on --verify, but I now feel silly for having stuck to gpg when gpg2 would have worked.

Solving point 2 from point 3 is easy, since I could simply clear-sign the provided document with any throwaway key I want, and extract the message digest value from there. Overkill, but still.

Finally, solving point 1 is trivial, by extracting the message digest algorithm and value from the clear-signed version using 3, and computing the corresponding one for the plain-text version using 2.

Once again, thanks. Pretty good hacking.
--
[Non-text portions of this message have been removed]



------------------------------------
Posted by: Nicolas Le Gland <***@legland.fr>
------------------------------------

______________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-***@yahoogroups.com
Gossamer Spider Web of Trust http://www.gswot.org

Yahoo Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/PGP-Basics/join
(Yahoo! ID required)

<*> To change settings via email:
PGP-Basics-***@yahoogroups.com
PGP-Basics-***@yahoogroups.com

<*> To unsubscribe from this group, send an email to:
PGP-Basics-***@yahoogroups.com

<*> Your use of Yahoo Groups is subject to:
https://info.yahoo.com/legal/us/yahoo/utos/terms/