Subject: version 3 header & USER ID packet

From: Erron Criddle <[email-masked]>
Date: Mon, 30 Oct 2000 16:40:26 +0800

To all,

We have been reading a public key-ring and have noticed that the CTB for 
the user id is:

10110101 that says:

10: Version 3 header
1101: User ID packet
01: 2 octet length

Now when I read the "File Formats Used by PGP 2.x", it says (under the User 
ID packet) that a User ID packet has a length of 1 octet.

 From this, either two things have happened:

a) The program that wrote the key-ring has used a default "two byte" length 
identifier when a CTB is created and when the User ID CTB has been created 
it simply leaves this as the User ID always uses a 1 octet length 
identifier with a version 3 header (as "File Formats used by PGP 2.x" 
indicates).

b) The public key-ring is bad.

Now, if b) should be followed then OK, however if a) should be followed, is 
there any other packets that follow this peculiar line?

I though that when a version 3 CTB is created for a User ID, it should read 
10110100, indicating a 1 octet length for the user ID, not 10110101???

TIA for the clarification...

Erron Criddle
Comasp Ltd.
Level 2, 45 Stirling Hwy
NEDLANDS  WA  6009
Australia

Fax: +61 8 9386 9473
Tel: + 61 8 9386 9534

http://www.comasp.com
[email-masked]

---

From: [email-masked]
Date: Mon, 30 Oct 2000 10:22:57 -0800

> ID packet) that a User ID packet has a length of 1 octet.

If the CTB says there is a two byte length, there better be a two byte
length.  It doesn't matter what "File Formats used by PGP 2.x" says,
after all, this CTB may not have been created by PGP 2.x.

Was there in fact a two byte length in this userid packet?  I.e. did the
next two bytes look like a reasonable length field?  If so, just use them.
If not, then it's a bad keyring.

Hal

---

From: Erron Criddle <[email-masked]>
Date: Tue, 31 Oct 2000 15:42:15 +0800

>after all, this CTB may not have been created by PGP 2.x.

not in this case.

>Was there in fact a two byte length in this userid packet?

no.

>   I.e. did the next two bytes look like a reasonable length field?  If 
> so, just use them.

The version 3 CTB's  last 2 bits were 01, indicating a two byte length 
field, however there was only one length byte (this worked in with the 
length of the User ID field (39 octets)).

Has anyone else any comments on this?

This key-ring that was extracted is from any one of the key-servers located at:

http://math-www.uni-paderborn.de/pgp/  or:

http://www.rediris.es/cert/index.en.html or:

http://keys.pgp.com:11371/     (the NAI server!)

using the keyword of:

0xFC4CC190

As many PGP key-servers contain this key-ring with a 2 byte length 
identifier in the CTB (see http://www.openpgp.net/pgpsrv.html) and a 1 byte 
length identifier for the actual User ID packet, what should we do? Should 
we accept it or have all the keyservers change their software so they check 
each transferred key-ring for mistakes like these? The latter seems a very 
large task.

Or is it easier to assume a 1 octet length indentifier for the User ID?

Regards

Erron Criddle
Comasp Ltd.
Level 2, 45 Stirling Hwy
NEDLANDS  WA  6009
Australia

Fax: +61 8 9386 9473
Tel: + 61 8 9386 9534

http://www.comasp.com
[email-masked]