in the announcement of the fix for this condition on the gnupg announce list, it says the following:
=====[ begin quoted text ]===== The only correct solution to this problem is to get rid of the feature to check concatenated signatures - this allows for strict checking of valid packet composition. This is what has been done in 1.4.2.2 and in the forthcoming 1.4.3rc2. These versions accept signatures only if they are composed of O + D + S S + D =====[ end quoted text ]===== am not sure of the difference between concatenated signatures and double-signed signatures double signed signatures are still allowed in 1.4.2.2 and still verified here is an example: -----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.2.2 (MingW32) Comment: armored double signed file, signed with two rsa keys owEBdwOI/JANAwAIAayhY/YEre4gAJANAwAIAWoFoLeFMG0lAawnYgdkc20udHh0 RBCwGnRlc3QgZG91YmxlIHNpZ25lZCBtZXNzYWdliQEVAwUARBCwGmoFoLeFMG0l AQh2wQgAmpw0z7++Fiebum0FR1psIfo9/231NsNfGlwPTrOwltir1XmcgeG6vuln S4+E1PSRZAXEKzqRrGLBM2yWC0QsbeWeHrkl6v56SxP7/Gu7fHc2esHRZ0vdcR6Y gg2RttrGwWN3Docmuufp4E6a55IVnhUDY5CJmvcPm7JYtxYJ7ufsCjGcqGhVGMdL Nx3tvIqNyX0yHnxGZyPbvMsvCBTUEIMmDS27MRwUa6DHVrKg04AIrCOC4Fgxl7x+ K4EVhV/aUjHHE+khRENCX9aUeNDxdkYy/N2uu3U2/6cCuaxhFoWrN8PYU4y0u0GM qqMx2vtj8neycqNdtx8P3kbqyFdSRYkCFQMFAEQQsBusoWP2BK3uIAEIeogP/0ng isFK3mGWJhYSfAHEGAdY+DcwMQyoisCTHZjRuKXKFJ/bq/Ol/Gz4rXOFjFilYsHE vp3tcH064PGXe7rJG4fbHWj/p8gMAIuxiaAvAVMAvgK7xbyfTi5IgLvgp7Zv9UrZ ID+RLlOSJNZZMN5/h3P/NDcIIrbTHOiAxej5ugKkJbFzoxdlVT7LLHLBSjEcLBaz aYjI5+wvGc1aqE3UATqT1yiJRjzVoLdaUqxvSsPCAMLcsQ6HSGvx+ODDIZoSC8d1 /x90+nXE+olo4uVcBqgIClBgletnoiIC0oKVxMAO0EcKz+VHpn+xBFJbQWFVIL+F 5Be1x1RmVHpExmMenaEMZ0I7jmmF8mbSBaGjuoaHDXG2hW05Tx/c1+bv2TyLl0kX I8TdHL27GwwlE8kpmmo2XODFKX5vlj3wOoXN9dkEtZs+qk7h88s3qQk79+0mfX5n eFa5/fvx7uBvRKsd3NKpnzbQvfDw3KfMlLX66cR0jp6QoSTQtrTsx5HOI8JtbFxR TEa2BV+eu6qmLa3ooYv66BNUn/FGiOfsqqWsjAxM5JHLoioXO4XXzNJtDlk6X6Vq HcNNKNPOrse40D4HUSN4dmwdGg+nlvCiQQde0DHbmyHpodu3J2qFh2OEWXIjs35c i/slwpqTqhU0ECFtNDhK7iv8Lue0IqxGyCaNlRBe =ySCn -----END PGP MESSAGE----- are double signed signatures not concatenated ? Thanks, vedaal Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users