On Sunday 10 Nov 2002 11:56 am, Trevor Warren wrote:

Tell me dudes....;)

How many of you'll really bother about the credibility of the mail that comes into your mailbox..????

Just a casual question....so chill.

Me, a lot if it is from my firends since I have probably taught all my friends how is it possible to send mails which are not authentic (that is telnet into a mail server and send a mail). I will not care to send a mail to the mailing list with a digital signature since the proof of an identity is not essential here, but all other mails should be Digitally encrypted and signed. The future of authentication lies here.

Trevor

Interesting query. Suprising, but though I have known that its possible to spoof someone's email when sending an email, I have never to bother thinking if the person who sent out the email is really who he says he is. I guess because I dont think I am important enough for some onee lse to impersonate

The funny thing is that sometimes, we have spoofed a person's email by opening an account in OE6 and sending mails from there. However, it has always been on a person's request. Now that I think of it, it would be very easy for me to send out this very email to the list as Trevor instead of Saswata (without digital signatures to authonticate)

Regards Saswata

----- Original Message ----- From: "Trevor Warren" trevor.w@media.mit.edu To: linuxers@mm.ilug-bom.org.in Sent: Sunday, November 10, 2002 11:56 AM Subject: Re: [ILUG-BOM] Digital Signature

Tell me dudes....;)

How many of you'll really bother about the credibility of the mail that comes into your mailbox..????

Just a casual question....so chill.

Trevor

-- ( >- GNU/LINUX, It's all about CHOICE -< ) /~\ __ http://www.qmailtheeasyway.com __ /~\ | ) / mailto: trevor.w@media.mit.edu \ (/ | |_|_ \ Research Asst, MediaLab / _|_| ___________________________________/

---

http://mm.ilug-bom.org.in/mailman/listinfo/linuxers

For some reason, I am getting your emails as txt and dat attachemnts.

Being paranoid about virus, I normally ignore attachments. Can you do something so that it comes as normal text emails instead of attachment

Regards Saswata

----- Original Message ----- From: "Sameer D. Sahasrabuddhe" sameerds@it.iitb.ac.in To: linuxers@mm.ilug-bom.org.in Sent: Sunday, November 10, 2002 10:19 AM Subject: Re: [ILUG-BOM] Digital Signature

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Sunday 10 Nov 2002 11:59 am, Bhargav Bhatt wrote:

You're using Microsoft Outlook Express 6.00.2720.3000.

It doesn't support the OpenPGP MIME method of signing/encrypting messages..

You see the way such emails are split up into attachments (separate attachments for actual message and encryption/signing info).

It is, I admit, annoying - but it's a flaw in Outlook Express. You should try some other client or maybe even OS:). HTH,

Sorry, but I have not even seen windows for more than a month and my comp has not touched windows for more than 1.5 years now.

I am using Kmail 1.4.3 (using KDE 3.0.4 on slackware-current), is it that even Kmail is not suporting OpenPGP (I am using GnuPGP) MIME methods?

On Sunday 10 November 2002 01:11 am, Saswata Banerjee & Associates wrote:

...

For some reason, I am getting your emails as txt and dat attachemnts.

Being paranoid about virus, I normally ignore attachments. Can you do something so that it comes as normal text emails instead of attachment

Regards Saswata

----- Original Message ----- From: "Sameer D. Sahasrabuddhe" sameerds@it.iitb.ac.in To: linuxers@mm.ilug-bom.org.in Sent: Sunday, November 10, 2002 10:19 AM Subject: Re: [ILUG-BOM] Digital Signature

---

http://mm.ilug-bom.org.in/mailman/listinfo/linuxers

- -- Visit http://munshi.dyndns.org/~amish/sign.txt to obtain a Public key of my digital signatute. Please verify always that the mail originates from me before reading the contents of the mail using any opensource encryption software such as gnupg or openpgp.

Get in touch with me at ICQ 85730949

Laziness stopped me from changing my email client (also lack of inciting alternatives on windows)

Same for OS

If many of you start sending openpgp signed messages, I will change both the OS and the Client

:-)

Regards Saswata

----- Original Message ----- From: "Bhargav Bhatt" bbb2004@columbia.edu To: linuxers@mm.ilug-bom.org.in Sent: Sunday, November 10, 2002 11:59 AM Subject: Re: [ILUG-BOM] Digital Signature

You're using Microsoft Outlook Express 6.00.2720.3000.

It doesn't support the OpenPGP MIME method of signing/encrypting messages..

You see the way such emails are split up into attachments (separate attachments for actual message and encryption/signing info).

It is, I admit, annoying - but it's a flaw in Outlook Express. You should try some other client or maybe even OS:). HTH,

On Sunday 10 November 2002 01:11 am, Saswata Banerjee & Associates wrote:

For some reason, I am getting your emails as txt and dat attachemnts.

Being paranoid about virus, I normally ignore attachments. Can you do something so that it comes as normal text emails instead of attachment

Regards Saswata

----- Original Message ----- From: "Sameer D. Sahasrabuddhe" sameerds@it.iitb.ac.in To: linuxers@mm.ilug-bom.org.in Sent: Sunday, November 10, 2002 10:19 AM Subject: Re: [ILUG-BOM] Digital Signature

---

http://mm.ilug-bom.org.in/mailman/listinfo/linuxers

-- Bhargav Bhatt, Department of Applied Physics and Applied Mathematics, Columbia University. -- "If English was commutative, we could all talk like Yoda." - Anonymous

_______________________________________________ http://mm.ilug-bom.org.in/mailman/listinfo/linuxers

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Hi,

I have tried to make some changes (in the Kmail settings changed the composer settings and removed the iso-8859-1 (locale) utf-8 I hope that now the attachments are in proper ASCII)

Let me know if they are still in dat and txt.

Bye.

On Sunday 10 Nov 2002 11:41 am, Saswata Banerjee & Associates wrote:

For some reason, I am getting your emails as txt and dat attachemnts.

Being paranoid about virus, I normally ignore attachments. Can you do something so that it comes as normal text emails instead of attachment

Regards Saswata

----- Original Message ----- From: "Sameer D. Sahasrabuddhe" sameerds@it.iitb.ac.in To: linuxers@mm.ilug-bom.org.in Sent: Sunday, November 10, 2002 10:19 AM Subject: Re: [ILUG-BOM] Digital Signature

---

http://mm.ilug-bom.org.in/mailman/listinfo/linuxers

- -- Visit http://munshi.dyndns.org/~amish/sign.txt to obtain a Public key of my digital signatute. Please verify always that the mail originates from me before reading the contents of the mail using any opensource encryption software such as gnupg or openpgp.

Get in touch with me at ICQ 85730949

On Sun, Nov 10, 2002 at 11:41:38AM +0530, Saswata Banerjee & Associates wrote:

For some reason, I am getting your emails as txt and dat attachemnts.

Being paranoid about virus, I normally ignore attachments. Can you do something so that it comes as normal text emails instead of attachment

Regards Saswata

----- Original Message ----- From: "Sameer D. Sahasrabuddhe" sameerds@it.iitb.ac.in

Is your message addressed to me or Amish? I'll check my setup anyway ...

Sameer.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Sunday 10 Nov 2002 10:19 am, Sameer D. Sahasrabuddhe wrote:

On Sun, Nov 10, 2002 at 08:59:17AM +0530, Amish K. Munshi wrote:

...

I just noticed that the digitally signed messages from my Kmail (1.4.3) is not recognised as a valid signature. Same is the case for vice-versa. Isnt there any standard for digital signatures, and how to organizations work with different mail clients (that is if they do work with different mail clients) when their digital signatures do not work.

I don't think that it is a client problem ... are you talking about GPG signatures? I notice you have a very fresh key which has not been signed by anyone ...

I had this problem between Kmail and evolution. I was just learning about the digital signatures and thought of working on this, just as an experiment setup created two users Amish and Prasad.

Amish and prasad created keys (Private and public) using gpg --gen-key

Then I do "gpg --export --armor amish@munshi.dyndns.org > /tmp/gpg_amish.txt" (as Amish)

and "gpg --export --armor prasad@munshi.dyndns.org > /tmp/gpg_prasad./txt" (As prasad)

Then as Amish I do "gpg --import < /tmp/gpg_prasad.txt"

and as Prasad "gpg --import < /tmp/gpg_amish.txt"

Now I start Kmail (v1.4.3) as Amish and evolution (v1.0.7) as Prasad. Amish sends a mail with digital signature but prasad does can not authenticate the mail. After thinking on what is wrong with this for more than 2 hours, I finally (just a co-incidence) started Kmail as Amish (which was already on) and Kmail as prasad, then the recognition happens instantaneously. So Kmail and evolution are not compactible when they send digitally signed messages.

Since you told that mutt recognised my signature (apart from that owners trust) so Kmail is compactible wth mutt but not with evolution.

Also I did not upload my present key since I have already uploaded two keys and do not know how to modify them, but just ended up creating dead keys on the server, and I dont think that there is any way that I can delete those keys from the servers. So, only after I have understood everything of signatures then only will I upload them to the servers.

I want a little more infor about this revokation certificate, if I format and reinstall my OS then can I use this revocation certificate to get my private and public keys again? if not then how do I make sure that I can use the same private and public keys even when i format the PC.

bash-2.05b$ gpg --fingerprint amish@munshi.dyndns.org gpg: WARNING: using insecure memory! gpg: please see http://www.gnupg.org/faq.html for more information pub 1024D/59D76813 2002-11-01 Amish K. Munshi amish@munshi.dyndns.org Key fingerprint = F3BD 07E2 E80E 3CB2 A504 7CE3 E9AA 6A84 59D7 6813 sub 1024g/3B7C9CF4 2002-11-01

This is the fingerprint I need to get right?

Thanks for the help.

Please post the error message you get about "invalid signature".

...

Visit http://munshi.dyndns.org/~amish/sign.txt to obtain a Public key of my digital signatute.

Slight confusion of terms here ... your public key is part of a pair - public and private. And the signature is message specific, created using your private key, which can be verified by anyone who has your public key.

...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQE9zdKO6apqhFnXaBMRAiupAKCR8Dsa6NIin8IE93CrsVhc1M0x/ACdGlbE T9zJjC3AS0d2VgxCIF/4uao= =wMwX -----END PGP SIGNATURE-----

Here's what mutt using gpg has to say about your signature:

[-- PGP output follows (current time: Sun Nov 10 09:59:42 2002) --] gpg: Signature made Sun Nov 10 08:59:18 2002 IST using DSA key ID 59D76813 gpg: Good signature from "Amish K. Munshi amish@munshi.dyndns.org" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: F3BD 07E2 E80E 3CB2 A504 7CE3 E9AA 6A84 59D7 6813

This is after I downloaded your public key from the URL you mentioned ... but my key database says that your public key is not "signed" by anyone I trust. So there's no way for gpg running on my machine to know whether this key really belongs to you. So everytime you get a signed message from someone, ensure you have their public key with you.

To tackle this, get your gpg-key fingerprint when you come to the meet. Write it down on a piece of paper, and be sure to bring valid identification documents with you, like license or college I-Card or passport.

man gpg gpg --fingerprint

BTW, I just noticed you have three keys registered on the public key servers, while the one you advertise currently isn't listed anywhere ... I don't think that's a very good idea. If you intend to stick to one of them, remember to revoke the others.

Sameer.

- -- Visit http://munshi.dyndns.org/~amish/sign.txt to obtain a Public key of my digital signatute. Please verify always that the mail originates from me before reading the contents of the mail using any opensource encryption software such as gnupg or openpgp.

Get in touch with me at ICQ 85730949

On Sun, 10 Nov 2002 13:01:24 +0530 "Amish K. Munshi" amish@munshi.dyndns.org wrote:

On Sunday 10 Nov 2002 11:45 am, Trevor Warren wrote: Also, I did not want to resend a message due to lack of information in the mail, so I prefer sending a long mail with as much info present Let me know what would you prefer, I will do the needfull if required.

[snip]

Do what you think is right.......:)

Trevor

Thanks for informing.

Bye.