From e04853203f6afce581ae04b0935181df650672f9 Mon Sep 17 00:00:00 2001 From: Yarmo Mackenbach Date: Fri, 9 Apr 2021 20:21:11 +0200 Subject: [PATCH] Fixed code sections --- content/blog/2020/06/2020-06-17--opsv.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/content/blog/2020/06/2020-06-17--opsv.md b/content/blog/2020/06/2020-06-17--opsv.md index c1f9e0c..c3e6585 100644 --- a/content/blog/2020/06/2020-06-17--opsv.md +++ b/content/blog/2020/06/2020-06-17--opsv.md @@ -33,7 +33,8 @@ Let's say I, Yarmo, would really like the world to know that I like pineapple. U The signed statement: -
-----BEGIN PGP SIGNED MESSAGE-----
+```
+-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
 I like pineapple.
@@ -53,7 +54,8 @@ Ab4hF7kO4z0Vh3JaKzcHey0pOzdNCPpAHZ51sAoAnFDM4PdMBgQxxVweCMu4KYMZ
 FN8sNn42oY/b7gDmwCelVhgD+rvUn/a8+B7CDmCp+wIquyrjrTt00voATcb+ZPMJ
 pTXJ/NcM
 =rqTX
------END PGP SIGNATURE-----
+-----END PGP SIGNATURE----- +``` Use this as "Signature" on [OPSV](https://opsv.foss.guru/). @@ -81,7 +83,8 @@ Remove the contents from the "Public Key (3: HKP)" field. It again verifies BUT The signature below does not contain a `userId`: -
-----BEGIN PGP SIGNED MESSAGE-----
+```
+-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
 I like pineapple.
@@ -100,7 +103,8 @@ VIGVVFnlWujNYYotmxys84OtE6ePfVRwHasIOLfknVq64RVo68Y1Pgw/KPXSb1k6
 dpm3RnjsbCFgZqEpclrEh2SD1e8eCjrNcouWK3jIfOkaWB2xk1KvNmdyQQTs3dkP
 /CpKcCJiNVvY9ogWxg9aUuQZUn4WvCvaEkmP4dfkk9s8yAKPQf8=
 =QqCq
------END PGP SIGNATURE-----
+-----END PGP SIGNATURE----- +``` Once again, the signature verifies. And again, it only verifies against the information contained within itself so **that doesn't prove anything about its authenticity**. Anyone can write this and the signature will return verified. @@ -114,7 +118,8 @@ One could not sign a statement with my private key: I, and only I, have access t One could however simply take any of my signed messages and change the content. Like so: -
-----BEGIN PGP SIGNED MESSAGE-----
+```
+-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
 I like privacy invasion.
@@ -134,7 +139,8 @@ eSLMMJ5cTuM60c0GSIPOxzBBsMRwa0HmEQ3HKgpnpkVYxoA00/hq91kuNavqUqM+
 OyOgbb21woPAG+S4OCHkOINEAooeCfhpSFtmpa87sUcfvDHUuX1ivL4rYoQO3cT2
 gNfjdSiB
 =tqZV
------END PGP SIGNATURE-----
+-----END PGP SIGNATURE----- +``` Given the wording of the statement, you naturally doubt the origin of it being me. You run it through OPSV and indeed, this is not what I wrote!