![[LWN Logo]](/images/lcorner.png)
![[Timeline]](/images/Included.png)
|
|
|
|
Date: Wed, 11 Oct 2000 12:30:19 -0700 From: Jim Small <cavenewt@MY-DEJA.COM> Subject: GPG 1.0.3 doesn't detect modifications to files with multiple To: BUGTRAQ@SECURITYFOCUS.COM Attached is multiple copies of a file I had signed. Then I started modifying parts of the SIGNED message. To see if gpg could detect that the messages had been altered. It did not detect them, so long as the last signed message had not been altered. Save this message as newfile.asc and run gpg --verify newfile.asc -o /dev/null to see for yourself (the key it was signed with is available via keyservers) asdfasfasdfd -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I just added by one stuff to thie message bogugfirst file encrypted with nobody dude on uinix box, send to nethole forpmail this is actually encrypted with a valid pgpg key imported form win95 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ= =siBR -----END PGP SIGNATURE----- middle stuff -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 another wrong first file encrypted with nobody dude on uinix box, send to nethole forpmail this is actually encrypted with a valid pgpg key imported form win95 another file -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE538hvZi9y1BQncn4RAolnAKCwEJTyPm6895ybQfk1D5IfeqJjmwCg4MlP 3NbvJocg5ksql40aOTZf0MY= =yBf2 -----END PGP SIGNATURE----- asfasfasf end stuff -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 first file encrypted with nobody dude on uinix box, send to nethole forpmail this is actually encrypted with a valid pgpg key imported form win95 bogud -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ= =siBR -----END PGP SIGNATURE----- stuff -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 first file encrypted with nobody dude on uinix box, send to nethole forpmail this is actually encrypted with a valid pgpg key imported form win95 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ= =siBR -----END PGP SIGNATURE----- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 first file encrypted with nobody dude on uinix box, send to nethole forpmail this is actually encrypted with a valid pgpg key imported form win95 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE538QlZi9y1BQncn4RAj/vAKCmfScBFegl6LMD3Q99N51pvuHAIQCfUv5+ a05Yt6xZwd/PxtQsRe+88AQ= =siBR -----END PGP SIGNATURE----- gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" gpg: Signature made Sat Oct 7 18:05:51 2000 PDT using DSA key ID 1427727E gpg: BAD signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" gpg: Signature made Sat Oct 7 17:47:33 2000 PDT using DSA key ID 1427727E gpg: Good signature from "James F. Small, Jr. <smallj@nethole.com>" gpg: aka "Jim Small <smallj@pacbell.net>" gpg: aka "James F. Small, Jr. <smallj@saic.com>" gpg: aka "James F. Small, Jr. <smallj@small.cx>" ------------------------------------------------------------ --== Sent via Deja.com http://www.deja.com/ ==-- Before you buy.