GPG User ID Comments and RFC 5322

[Philippe Cerfon]

Hi again.

Some days ago I was reading RFC 5322 which will probably become the
new standard for internet mail.


In sections 3.4 and 3.4.1 it says:

>Also, because some legacy
>implementations interpret the comment, comments generally SHOULD
>NOT be used in address fields to avoid confusing such
>implementations.

and

>Comments and folding white space
>SHOULD NOT be used around the "@" in the addr-spec.


As far as I can see this is what gnupg does when users set a Comment
when they create their key. It has the same format: "(" phrase ")"

Also the RFC means these comments (as far as I understand) more as
real comments as you know them from C/C++,.. that are totally ignored
by the clients/programs, while gpg does (of course) not ignore them
but also interpret them more as and additional note to the name e.g.:
Charles de Gaulle (président) <there.were@...>
in contrast to
Charles de Gaulle (teacher) <cdg@...>


Just wanted you to know this, that you can react if you think this
should be done.

Cheers,
Philppe

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[David Shaw]

On Sep 11, 2009, at 9:54 AM, Philippe Cerfon wrote:

> Hi again.
>
> Some days ago I was reading RFC 5322 which will probably become the
> new standard for internet mail.
>
>
> In sections 3.4 and 3.4.1 it says:
>
>> Also, because some legacy
>> implementations interpret the comment, comments generally SHOULD
>> NOT be used in address fields to avoid confusing such
>> implementations.
>
> and
>
>> Comments and folding white space
>> SHOULD NOT be used around the "@" in the addr-spec.
>
>
> As far as I can see this is what gnupg does when users set a Comment
> when they create their key. It has the same format: "(" phrase ")"
>
> Also the RFC means these comments (as far as I understand) more as
> real comments as you know them from C/C++,.. that are totally ignored
> by the clients/programs, while gpg does (of course) not ignore them
> but also interpret them more as and additional note to the name e.g.:
> Charles de Gaulle (président) <there.were@...>
> in contrast to
> Charles de Gaulle (teacher) <cdg@...>

GPG generally ignores comments.  They're intended as messages from one  
human to another, and not GPG's responsiblity.  You can search on the  
field, but (with one exception) GPG will not act differently depending  
on what it finds in there.

(The exception is if you put a comment in that says the key is  
"insecure" or "do not use", GPG will believe you)

David


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Philippe Cerfon]

On Sun, Sep 13, 2009 at 12:28 AM, David Shaw <dshaw@...> wrote:
> GPG generally ignores comments.  They're intended as messages from one human
> to another, and not GPG's responsiblity.  You can search on the field, but
> (with one exception) GPG will not act differently depending on what it finds
> in there.
Isn't this a problem? If gpg handles keys (or even different keys)
with user IDs that only differ by their comment,.. but gpg ignores
this?


> (The exception is if you put a comment in that says the key is "insecure" or
> "do not use", GPG will believe you)
What if use insecure in another language? Or "non-insecure"? :P

Apart from all that, I've read some pages of the RFC where it says
User IDs are basically just strings without any special format. So
shouldn't gpg ignore this comment-speciality from emails and just take
it as strings?


Cheers,
Philippe.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[David Shaw]

On Sep 13, 2009, at 1:04 PM, Philippe Cerfon wrote:

> On Sun, Sep 13, 2009 at 12:28 AM, David Shaw <dshaw@...>  
> wrote:
>> GPG generally ignores comments.  They're intended as messages from  
>> one human
>> to another, and not GPG's responsiblity.  You can search on the  
>> field, but
>> (with one exception) GPG will not act differently depending on what  
>> it finds
>> in there.
> Isn't this a problem? If gpg handles keys (or even different keys)
> with user IDs that only differ by their comment,.. but gpg ignores
> this?

GPG does really not do anything with the user ID beyond allowing you  
to search with it.  The key ID is how GPG manipulates keys.  The user  
ID is for human beings.

David


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Werner Koch]

On Sun, 13 Sep 2009 19:04, philcerf@... said:

>> (The exception is if you put a comment in that says the key is "insecure" or
>> "do not use", GPG will believe you)
> What if use insecure in another language? Or "non-insecure"? :P
>
> Apart from all that, I've read some pages of the RFC where it says
> User IDs are basically just strings without any special format. So
> shouldn't gpg ignore this comment-speciality from emails and just take
> it as strings?

That is what gpg does.

The thing with "(insecure!)", "not secure" or "do not use" in a user id
is a hack to detect test keys likely created in a special testing mode
using a faked random number generator.


Salam-Shalom,

   Werner

--
Die Gedanken sind frei.  Auschnahme regelt ein Bundeschgesetz.


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel