Subject: 5.1 Clarification re padding

From: Erron Criddle <[email-masked]>
Date: Thu, 08 Jun 2000 14:03:58 +0800

To all,

I noticed in section 5.1 that (third last paragraph):

-----BEGIN SECTION-----

"This value is then padded as described in PKCS-1 block type 02 [RFC2437] 
to form the "m" value used in the formulas above."

-----END SECTION-----

I have looked through RFC2437 and I cannot see any reference to a block 
type 02 or any specific details on padding.

Can someone please point me to a document that details the padding 
mechanism to use in 5.1 as I wouldn't have a clue at the moment :)

TIA.

---

From: [email-masked]
Date: Sat, 08 Jul 2000 18:50:51 +0900

From: Erron Criddle <[email-masked]>
Subject: 5.1 Clarification re padding
Date: Thu, 08 Jun 2000 14:03:58 +0800
Message-ID: <[email-masked]>

> to form the "m" value used in the formulas above."

hmm, that's not what it says in my copy...ah, i see that the quoted
part if probably from one of the bis documents.  i think that may be
an error.

> type 02 or any specific details on padding.

neither can i ;-)

> mechanism to use in 5.1 as I wouldn't have a clue at the moment :)

try rfc 2313.  that's the reference made in my copy of rfc 2440, and it
does mention a block of type 2.

---

From: Ulf Möller <[email-masked]>
Date: Sat, 8 Jul 2000 09:07:46 -0400

> to form the "m" value used in the formulas above."

The OpenPGP RFC refers to RFC 2313. In a later draft, Jon Callas changed
the reference to RFC 2437, but failed to update the contents.

In terms of RFC 2437, OpenPGP uses EME-PKCS1-v1_5 and EMSA-PKCS1-v1_5.

---

From: Erron Criddle <[email-masked]>
Date: Sat, 10 Jun 2000 10:21:57 +0800

Ulf, Sen and others,

>In terms of RFC 2437, OpenPGP uses EME-PKCS1-v1_5 and EMSA-PKCS1-v1_5.

I believe I have it worked out now...after reading the "File Formats used 
by 2.x" document, 2313 and 2437, does the m value look like this?:

m = 0x00 0x02 (random non zero data - 8 bytes minimum) 0x00 0x0A (session 
key) (checksum)

The 0x0A represents the Twofish algorithm.

TIA.

Regards 
Comasp Ltd.
                                                                Level 2, 45 
Stirling Hwy
                                                                NEDLANDS 
WA  6009 

                                                               http://www.comasp.com

Erron Criddle                                                     Tel: 08 
9386 9534
[email-masked]                                            Fax: 08 9386 9473

---

From: [email-masked]
Date: Mon, 10 Jul 2000 12:53:56 +0900

From: Erron Criddle <[email-masked]>
Subject: Re: 5.1 Clarification re padding
Date: Sat, 10 Jun 2000 10:21:57 +0800
Message-ID: <[email-masked]>

...

> The 0x0A represents the Twofish algorithm.

that's reflects my current understanding.  

to all:

i've been curious about the length of the random padding octets.  i
presume none of them are allowed to 0x00 (that's what non-zero data
means, may be?) and thus the 0x00 value preceding the
algorithm-specifying octect can serve as a "marker" to indicate where
the random padding ends.  is that correct?

---

From: Erron Criddle <[email-masked]>
Date: Sat, 10 Jun 2000 12:32:28 +0800

At 12:53 PM 10/07/2000 +0900, [email-masked] wrote:

<snip>

>the random padding ends.  is that correct?

Yes. The doc located at:

ftp.pgpi.org/pub/pgp/2.x/doc/pgformat.txt

explains that in the section entitled:

"Conventional Data Encryption Key (DEK) "packet""

It also notes it in 2437 (with reference to Ulf's pointers to the padding 
section/s) and 2313, that you have to use NON ZERO values in the random number.

Regards 
Comasp Ltd.
                                                                Level 2, 45 
Stirling Hwy
                                                                NEDLANDS 
WA  6009 

                                                               http://www.comasp.com

Erron Criddle                                                     Tel: 08 
9386 9534

---

From: [email-masked]
Date: Mon, 10 Jul 2000 14:02:09 +0900

From: Erron Criddle <[email-masked]>
Subject: Re: 5.1 Clarification re padding
Date: Sat, 10 Jun 2000 12:32:28 +0800
Message-ID: <[email-masked]>

> section/s) and 2313, that you have to use NON ZERO values in the random number.

thanks for the reference!

upon closer inspection of rfc2313, i see:

   The padding string PS shall consist of k-3-||D|| octets. For block
   type 00, the octets shall have value 00; for block type 01, they
   shall have value FF; and for block type 02, they shall be
   pseudorandomly generated and nonzero.  This makes the length of the
   encryption block EB equal to k.

sorry for the extra traffic.