From: laszlo@kth.se (Laszlo Baranyi)
Subject: signed archives
Reply-To: laszlo@kth.se (Laszlo Baranyi)
Organization: Royal Institute of Technology, Stockholm, Sweden
Date: Sun, 24 Jan 1993 17:13:01 GMT

Newsgroups:alt.test
Subject:signed archives


How i use pgp to sign ZIP-files

The main idea:
No need to get programs from trusted sources. Get the 
distributors public key instead. (BBS/ftp sites)

benefits:
    
    Most BBSs routinely scans incomming files for viruses
    before moving them to the download area. If they also signs
    the output of the antivirusprogram, and the checksums from
    PKZIP, the signature allows the unpacker to verify who is 
    responsible for the archives integrity.

    A swedish lawproosal gives a virusspreader up to 6 (six) years
    By signing the file, the sysop is guarded since he can proof that
    the antivirusprogram failed to detect the virus.	

    A file can be signed by several BBSes as it 
    comes in their way. The first signature is called 0SIGNED.ZIP.
    The next BBS that wants to sign, adds his signature in 
    1SIGNED.ZIP, and so on. An archive can thus be signed by 100 
    signatures.

    No uppdate costs to verify theese once signed files.
    It is also protected against any future versions of 
    viruses. 
    
    If the file _does_ contain a virus, then you know how
    it was spread, and it might even be possible to trace the real
    source through the attached timestamped signatures. 

    The signature is ZIP:ed into the original archive,
    and is verifyed before the real unpacking.
    
    The only thing that differs a signed archive from a normal one,
    is an included file, 0SIGNED.ZIP, so users who dont care about 
    theese thing, just unpacks in usaual way.

One way for BBS:es to spread thir public key could be the nodelist.
But that would i guess be a to big change and size of the nodelist.

--
the method to sign:


*	Make a Zip archive as usual, here called ORIGINAL.ZIP
*	Create an report wich includes the CRC checksums of the
	archive, and sign it.
	PKZIP -vn ORIGINAL.ZIP >ZIPCRC.TXT
	PGP -sta +clearsig=on ZIPCRC.TXT -u my_name
*	A preprepared signed textfile, ID_MSG.ASC, contains info
	about where your public key and pgp can be fetched.
	ZIP it together with the checksumreport.
	PKZIP -a 0SIGNED.ZIP ZIPCRC.ASC ID_MSG.ASC
*	Move the signature into the original archive
	PKZIP -a ORIGINAL.ZIP 0SIGNED.ZIP
	 
To verify archive signature:

*	move out the ZIP:ed signature file from archive
	PKUNZIP ORIGINAL.ZIP 0signed.zip
	PKZIP -d ORIGINAL.ZIP 0signed.zip
*	Let PKZIP create a new checksums report of the original
	archive
	PKZIP -vn ORIGINAL.ZIP >zipcrc.tmp
*	copy out the signed checksum from 0SIGNED.ZIP
	PKUNZIP 0signed.zip zipcrc.asc
*	compare for equality
	comp zipcrc.tmp zipcrc


Also, i include information and BAT-files in the archive to make
it easier for the signer/unpacker. (Mail me for theese)

I dont include my public key in the archive, since it would
more difficult to revoke it. (unpackers are too lazy to doublecheck
the validity of the public key) But thoose who wants to take the 
chance, do so.

I have looked at the pgp packer, hpack78. But what is it's 
advantages over mixing, like above, with pgp and ZIP ?
Newsgroups: alt.test