[BOUNTY: 2.0 BTC] [CLAIMED] Message Signing in Armory

[jackjack]

The new version is online, I tested only with a message of 400 characters but it should be ok

You're not duplicating anything (sadly)
I think the readme is clear enough but tell me if you have trouble parsing things

[CircusPeanut]

Thanks. Just pulled it. I'm sure something else will break before this reaches it's limit.

[CircusPeanut]

JackJack,


I'm reviewing the dash-escape code in jasvet.py, and I'm unsure whether the code in FormatText() follows rfc2440 exactly:

Dash escaped cleartext is the ordinary cleartext where every line
starting with a dash '-' (0x2D) is prefixed by the sequence dash '-'
(0x2D) and space ' ' (0x20).

The I way interpret this is that ".../n/r-some text..." would be displayed as ".../n/r- -some text..." but FormatText() returns ".../n/r- some text...".

The latter seems better because it's one character closer to the original and achieves the same purpose.

However, I'm concerned that someone might used Armory to verify a message that is cleartext signed by a different application and yield an incorrect response.

Do you think that this is a valid concern? Do you know of any other rfc2440 implementations that indicate which way is correct?

[jackjack]

JackJack,


I'm reviewing the dash-escape code in jasvet.py, and I'm unsure whether the code in FormatText() follows rfc2440 exactly:

Dash escaped cleartext is the ordinary cleartext where every line
starting with a dash '-' (0x2D) is prefixed by the sequence dash '-'
(0x2D) and space ' ' (0x20).

The I way interpret this is that ".../n/r-some text..." would be displayed as ".../n/r- -some text..." but FormatText() returns ".../n/r- some text...".

The latter seems better because it's one character closer to the original and achieves the same purpose.

However, I'm concerned that someone might used Armory to verify a message that is cleartext signed by a different application and yield an incorrect response.

Do you think that this is a valid concern? Do you know of any other rfc2440 implementations that indicate which way is correct?

Indeed it seems I understood that the wrong way

I thought the '-' of the line was not part of the prefixed thing, I didn't find any examples of implementations but the rfc is clear enough:

every line starting with a dash is prefixed

That means the dash is actually part of what is prefixed

Thank you for bringing this to my attention
I'll fix that soon, in the mean time you just have to replace line 506:
from

l='- '+l[1:]

to

l='- '+l

[CircusPeanut]

Excellent! Thanks for the confirmation. That's what I ended up doing. Now I can be sure that's the correct solution.

[CircusPeanut]

Found a bug in the FormatText() method. Easy fix:

This line:

Code:

      while len(l) and l[len(l)-1] in [' ', '\t', chr(9)]:

Should include '\r':

Code:

      while len(l) and l[len(l)-1] in [' ', '\r', '\t', chr(9)]:

Without this it fails to strip spaces from the ends of lines terminated with '\r\n'