RFC 3156

MIME Security with OpenPGP

📅 published August 2001, from ietf

MIME Security with OpenPGP 🎀

Part 1 of 3 💅

RFC 3156 is a Standards Track document from the Network Working Group 🌸, and it's a sequel of sorts to RFC 2015. The authors are M. Elkins (Network Associates, Inc.), D. Del Torto (CryptoRights Foundation), R. Levien (University of California at Berkeley), and T. Roessler 👑. It came out in August 2001, and it updates RFC 2015 ✨.

Status of This Memo 📜

okay so this document specifies an Internet standards track protocol for the Internet community, and it's asking everyone to talk about it and suggest improvements 🗣️. If you want to know where this protocol stands in the official standardization process, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚. And distribution of this memo is unlimited, so share it with everyone 🦋.

Copyright (C) The Internet Society (2001). All Rights Reserved. 💜

Abstract ✨

this doc explains how the OpenPGP Message Format can give you privacy and authentication through the Multipurpose Internet Mail Extensions (MIME) security content types described in RFC 1847 🔐. It's giving "secure email, but make it structured" 💖.

1. Introduction 🌷

bestie, let's talk history 📖. Before RFC 2015, people were trying to put PGP (Pretty Good Privacy) together with MIME [3], and that included the since withdrawn "application/pgp" content type 🥲. The big problem? You couldn't get the signed message body back out without parsing data structures that were specific to PGP 😭. RFC 2015 fixed this with the elegant solution from RFC 1847, which defines security multipart formats for MIME 🙌. Those security multiparts cleanly separate the signed message body from the signature, and they have a bunch of other desirable properties too 💅. This document revises RFC 2015 so the integration of PGP and MIME matches what came up while the OpenPGP specification was being worked on 🧚.

This document defines three content types for security and privacy with OpenPGP: "application/pgp-encrypted", "application/pgp-signature" and "application/pgp-keys" 🍓.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 ⭐. These are the capital-letter vibes that mean something, so keep an eye out for them 👀.

2. OpenPGP data formats 🎀

OpenPGP implementations can output either ASCII armor (described in [1]) or 8-bit binary output when they encrypt data, generate a digital signature, or extract public key data 🦋. The ASCII armor output is the REQUIRED method for data transfer 🫶. The reason? It lets users who can't interpret the formats in this document still extract and use the OpenPGP information in the message 🌈.

When the amount of data is big enough that it has to be sent in many parts, the MIME message/partial mechanism SHOULD be used instead of the multi-part ASCII armor OpenPGP format 💜. Think of it as picking the right tool for a big job 🧺.

3. Content-Transfer-Encoding restrictions 🔒

okay, this section is lowkey the most important one for keeping signatures alive 😭. Multipart/signed and multipart/encrypted are to be treated by agents as opaque, meaning the data must not be altered in any way [2], [7] 🫙. BUT many existing mail gateways will check whether the next hop supports MIME or 8-bit data, and if it doesn't, they'll convert things to either Quoted-Printable or Base64 💀. That's a serious problem for multipart/signed, because the signature gets invalidated when that happens 🙈. So for this reason, all data signed according to this protocol MUST be constrained to 7 bits (8-bit data MUST be encoded using either Quoted-Printable or Base64) 🔥. This also covers the case where a signed object is also encrypted (see section 6) 🌸. This restriction makes it more likely that the signature will still be valid when it arrives 💖.

Also, implementations MUST make sure that no trailing whitespace is present after the MIME encoding has been applied ✨. Trailing whitespace is sneaky, bestie 🥺.

Note: In most cases, trailing whitespace can either be removed, or protected by applying an appropriate content-transfer-encoding. BUT be extra careful with any header lines that only consist of whitespace, whether they're in MIME entity headers or in embedded RFC 822 headers 🙃. Those lines must be removed entirely, because replacing them with empty lines would turn them into header delimiters and change the meaning of the message 😱. The whitespace restrictions are needed so the hash stays invariant under the text and binary mode signature mechanisms provided by OpenPGP [1] 🧠. They also help avoid compatibility problems with PGP implementations that came before the OpenPGP specification 🧓.
Note: If any line begins with the string "From ", it's strongly suggested that either the Quoted-Printable or Base64 MIME encoding be applied 🫣. If Quoted-Printable is used, at least one of the characters in that string should be encoded using the hexadecimal coding rule. Why? Lots of mail transfer and delivery agents treat "From " (the word "from" followed right away by a space character) as the start of a new message, so they stick a right angle-bracket (>) in front of any line starting with "From " to mark it, and that invalidates the signature 💀.

Data that is ONLY to be encrypted is allowed to contain 8-bit characters and trailing whitespace 🌈. That means it doesn't need the conversion to a 7-bit format or the whitespace stripping 🫶.

Implementor's note: It cannot be stressed enough that applications using this standard follow MIME's suggestion that you "be conservative in what you generate, and liberal in what you accept." 👑 In this case, it would be wise for an implementation to accept messages with any content-transfer-encoding, but restrict generation to the 7-bit format required by this memo 🎀. That way you'll stay compatible in the future, if the Internet SMTP framework ever becomes 8-bit friendly 🔮.

4. OpenPGP encrypted data 🔐

first things first: before OpenPGP encryption, the data gets written in MIME canonical format (body and headers) 🧁.

OpenPGP encrypted data is denoted by the "multipart/encrypted" content type, described in [2] 💌. It MUST have a "protocol" parameter value of "application/pgp-encrypted" ✨. Also, the value of that parameter MUST be enclosed in quotes 🎀.

The multipart/encrypted MIME body MUST consist of exactly two body parts, and the first one has the content type "application/pgp-encrypted" 🌷. This body holds the control information 🧭. A message that complies with this standard MUST contain a Version: 1 field in this body 💖. Since the OpenPGP packet format already has all the other info needed for decrypting, no other information is required here 🧚.

The second MIME body part MUST contain the actual encrypted data 🦋. It MUST be labeled with the content type "application/octet-stream" 🍓.

Here's an example message so you can see the whole thing in action 👀🌸:

From: Michael Elkins <elkins@aero.org>
To: Michael Elkins <elkins@aero.org>
Mime-Version: 1.0
Content-Type: multipart/encrypted; boundary=foo;
   protocol="application/pgp-encrypted"

--foo
Content-Type: application/pgp-encrypted

Version: 1

--foo
Content-Type: application/octet-stream

-----BEGIN PGP MESSAGE-----
Version: 2.6.2

hIwDY32hYGCE8MkBA/wOu7d45aUxF4Q0RKJprD3v5Z9K1YcRJ2fve87lMlDlx4Oj
eW4GDdBfLbJE7VUpp13N19GL8e/AqbyyjHH4aS0YoTk10QQ9nnRvjY8nZL3MPXSZ
g9VGQxFeGqzykzmykU6A26MSMexR4ApeeON6xzZWfo+0yOqAq6lb46wsvldZ96YA
AABH78hyX7YX4uT1tNCWEIIBoqqvCeIMpp7UQ2IzBrXg6GtukS8NxbukLeamqVW3
1yt21DYOjuLzcMNe/JNsD9vDVCvOOG3OCi8=
=zzaA
-----END PGP MESSAGE-----

--foo--

the way this structure is so clean ✨🌈✨

5. OpenPGP signed data ✨

okay bestie, let's get into signed messages 💅 an OpenPGP signed message is marked with the "multipart/signed" content type from [2] 🎀, and its "protocol" parameter MUST be "application/pgp-signature" (and it MUST be quoted, no exceptions 🙈).

The "micalg" parameter for that protocol MUST contain exactly one hash-symbol in the form pgp-<hash-identifier> 🌸, where <hash-identifier> names the Message Integrity Check (MIC) algorithm used to make the signature. You build the hash-symbol by taking the text name registered in [1] (or following the mechanism that doc defines), lowercasing it, and sticking the four characters pgp- on the front 💜.

Currently defined values are pgp-md5, pgp-sha1, pgp-ripemd160, pgp-md2, pgp-tiger192, and pgp-haval-5-160 🦋.

The multipart/signed body MUST consist of exactly two parts 👑. The first part holds the signed data in MIME canonical format, along with a set of proper content headers describing it. The second body MUST contain the OpenPGP digital signature, and it MUST be labeled with a content type of application/pgp-signature 🫶.

Note: implementations can produce either "signatures of a canonical text document" or "signatures of a binary document", as defined in [1]. The restrictions on signed material in section 3 and in this section make sure that the various MIC algorithm variants specified in [1] and [5] all produce the same result 🔥.

When generating the OpenPGP digital signature, here's the order of operations (it's giving recipe energy 🍓):

(1) The data to be signed MUST first be converted to its content-type specific canonical form. For text/plain, that means converting to an appropriate character set and converting line endings to the canonical <CR><LF> sequence 🌈.

(2) An appropriate Content-Transfer-Encoding is then applied; see section 3. In particular, line endings in the encoded data MUST use the canonical <CR><LF> sequence where appropriate. The canonical line ending may or may not be on the last line of encoded data, and if it's absent, it MUST NOT be included in the signature 💀.

(3) MIME content headers are then added to the body, each ending with the canonical <CR><LF> sequence 🧚.

(4) As described in section 3 of this document, any trailing whitespace MUST then be removed from the signed material 🫧.

(5) As described in [2], the digital signature MUST be calculated over both the data to be signed and its set of content headers 💖.

(6) The signature MUST be generated detached from the signed data, so the process does not alter the signed data in any way 🦋.

Note: the accepted OpenPGP convention is for signed data to end with a <CR><LF> sequence. The <CR><LF> sequence right before a MIME boundary delimiter line counts as part of the delimiter in [3], 5.1 🙈. So it isn't part of the signed data before the delimiter. An implementation that follows the OpenPGP convention has to make sure it inserts a <CR><LF> pair on the last line of the data to be signed and transmitted (signed message and transmitted message MUST be identical) ✨.

Here's an example message. The lines marked with "&" are the portion of the data the signature was calculated over 💅:

     From: Michael Elkins <elkins@aero.org>
     To: Michael Elkins <elkins@aero.org>
     Mime-Version: 1.0
     Content-Type: multipart/signed; boundary=bar; micalg=pgp-md5;
       protocol="application/pgp-signature"

     --bar
  & Content-Type: text/plain; charset=iso-8859-1
  & Content-Transfer-Encoding: quoted-printable
  &
  & =A1Hola!
  &
  & Did you know that talking to yourself is a sign of senility?
  &
  & It's generally a good idea to encode lines that begin with
  & From=20because some mail transport agents will insert a greater-
  & than (>) sign, thus invalidating the signature.
  &
  & Also, in some cases it might be desirable to encode any   =20
  & trailing whitespace that occurs on lines in order to ensure  =20
  & that the message signature is not invalidated when passing =20
  & a gateway that modifies such whitespace (like BITNET). =20
  &
  & me

     --bar

     Content-Type: application/pgp-signature

     -----BEGIN PGP MESSAGE-----
     Version: 2.6.2

     iQCVAwUBMJrRF2N9oWBghPDJAQE9UQQAtl7LuRVndBjrk4EqYBIb3h5QXIX/LC//
     jJV5bNvkZIGPIcEmI5iFd9boEgvpirHtIREEqLQRkYNoBActFBZmh9GC3C041WGq
     uMbrbxc+nIs1TIKlA08rVi9ig/2Yh7LFrK5Ein57U/W72vgSxLhe/zhdfolT9Brn
     HOxEa44b+EI=
     =ndaj
     -----END PGP MESSAGE-----

     --bar--

Once a signed message arrives, an application MUST do two things 🔍:

(1) Convert line endings to the canonical <CR><LF> sequence before the signature can be verified. This is needed because the local MTA may have converted to a local end of line convention 🌸.

(2) Pass both the signed data and its associated content headers, along with the OpenPGP signature, to the signature verification service 🦋.

6. Encrypted and Signed Data 🔐

Sometimes you want to both sign AND encrypt a message, and this protocol gives you two ways to pull that off 💜.

6.1. RFC 1847 Encapsulation

In [2], the data is first signed as a multipart/signature body, and then encrypted to form the final multipart/encrypted body. This one is most useful for standard MIME-compliant message forwarding 🎀.

Example:

     Content-Type: multipart/encrypted;
        protocol="application/pgp-encrypted"; boundary=foo

     --foo
     Content-Type: application/pgp-encrypted

     Version: 1

     --foo
     Content-Type: application/octet-stream

     -----BEGIN PGP MESSAGE-----
  & Content-Type: multipart/signed; micalg=pgp-md5
  &     protocol="application/pgp-signature"; boundary=bar
  &
  & --bar
  & Content-Type: text/plain; charset=us-ascii
  &
  & This message was first signed, and then encrypted.
  &
  & --bar
  & Content-Type: application/pgp-signature
  &
  & -----BEGIN PGP MESSAGE-----
  & Version: 2.6.2
  &
  & iQCVAwUBMJrRF2N9oWBghPDJAQE9UQQAtl7LuRVndBjrk4EqYBIb3h5QXIX/LC//
  & jJV5bNvkZIGPIcEmI5iFd9boEgvpirHtIREEqLQRkYNoBActFBZmh9GC3C041WGq
  & uMbrbxc+nIs1TIKlA08rVi9ig/2Yh7LFrK5Ein57U/W72vgSxLhe/zhdfolT9Brn
  & HOxEa44b+EI=
  & =ndaj
  & -----END PGP MESSAGE-----
  &
  & --bar--
     -----END PGP MESSAGE-----

     --foo--

(The text preceded by '&' shows that it's really encrypted, but it's presented as text for clarity 👀.)

6.2. Combined method

The OpenPGP packet format [1] describes a way to sign and encrypt data in one single OpenPGP message 🧁. This method is allowed to cut processing overhead and boost compatibility with non-MIME implementations of OpenPGP ✨. The result is formatted as a "multipart/encrypted" object, as described in Section 4.

Messages that are encrypted and signed this way are REQUIRED to follow the same canonicalization rules as multipart/signed objects 💅.

It is explicitly allowed for an agent to decrypt a combined message and rewrite it as a multipart/signed object, using the signature data embedded in the encrypted version 🦋.

7. Distribution of OpenPGP public keys 🗝️

Content-Type: application/pgp-keys
Required parameters: none
Optional parameters: none

A MIME body part of the content type "application/pgp-keys" contains ASCII-armored transferable Public Key Packets as defined in [1], section 10.1 💖.

8. Security Considerations ⚠️

Signatures of a canonical text document as defined in [1] ignore trailing white space in signed material. Implementations that choose to use signatures of canonical text documents will NOT be able to detect whitespace being added in transit 😭. This is a real gotcha, bestie, so keep it in mind 🚨.

See [3], [4] for more information on the security considerations for the underlying protocols 🔐.

9. IANA Considerations 📋

This document defines three media types: "application/pgp-encrypted", "application/pgp-signature" and "application/pgp-keys" 🎀. The following sections specify the IANA registrations for these types.

9.1. Registration of the application/pgp-encrypted media type

MIME media type name: application
MIME subtype name: pgp-encrypted
Required parameters: none
Optional parameters: none

Encoding considerations:

   Currently this media type always consists of a single 7bit text
   string.

Security considerations:

   See Section 8 and RFC 2440 Section 13.

Interoperability considerations: none

Published specification:

   This document.

Additional information:

   Magic number(s): none
   File extension(s): none
   Macintosh File Type Code(s): none

Person & email address to contact for further information:

   Michael Elkins
   Email: me@cs.hmc.edu

Intended usage: common

Author/Change controller:

   Michael Elkins
   Email: me@cs.hmc.edu

9.2. Registration of the application/pgp-signature media type

MIME media type name: application
MIME subtype name: pgp-signature
Required parameters: none
Optional parameters: none

Encoding considerations:

   The content of this media type always consists of 7bit text.

Security considerations:

   See Section 8 and RFC 2440 Section 13.

Interoperability considerations: none

Published specification:

   RFC 2440 and this document.

Additional information:

   Magic number(s): none
   File extension(s): asc, sig
   Macintosh File Type Code(s): pgDS

Person & email address to contact for further information:

   Michael Elkins
   Email: me@cs.hmc.edu

Intended usage: common

Author/Change controller:

   Michael Elkins
   Email: me@cs.hmc.edu

9.3. Registration of the application/pgp-keys media type

MIME media type name: application
MIME subtype name: pgp-keys
Required parameters: none
Optional parameters: none
Encoding considerations:

   The content of this media type always consists of 7bit text.

Security considerations:

   See Section 8 and RFC 2440 Section 13.

Interoperability considerations: none

Published specification:

   RFC 2440 and this document.

Additional information:

   Magic number(s): none
   File extension(s): asc
   Macintosh File Type Code(s): none

Person & email address to contact for further information:

   Michael Elkins
   Email: me@cs.hmc.edu

Intended usage: common

Author/Change controller:

   Michael Elkins
   Email: me@cs.hmc.edu

10. Notes 📝

"PGP" and "Pretty Good Privacy" are registered trademarks of Network Associates, Inc. 💜

11. Acknowledgements 🫶

okay so this whole doc leans on the OpenPGP Working Group's work on the OpenPGP Message Format 🧚 right now that format is described in RFC 2440 [1], which is literally the foundation everything else is built on 💅

bestie, we have to shout out Philip Zimmermann for his original and ongoing work on PGP 👑 we also owe a huge thank you to Charles Breed, Jon Callas and Dave Del Torto for originally proposing the OpenPGP Working Group, and to Steve Schoenfeld for super helpful feedback during the draft process ✨ the authors also want to thank the engineers at Pretty Good Privacy, Inc (now Network Associates, Inc) for their technical commentary, which means Colin Plumb, Hal Finney, Jon Callas, Mark Elrod, Mark Weaver and Lloyd Chambers 🌸

more legends 🙌 Jeff Schiller and Derek Atkins for their continuing support of strong cryptography and PGP freeware at MIT 🎀 Rodney Thayer of Sable Technology 🦋 John Noerenberg, Steve Dorner and Laurence Lundblade of the Eudora team at QUALCOMM, Inc 💜 Bodo Moeller gets props for proposing the approach followed with respect to trailing whitespace 🍓 and John Gilmore, Hugh Daniel and Fred Ringel (at Rivertown) plus Ian Bell (at Turnpike) for their timely critical commentary 🔥

also William Geiger, Lutz Donnerhacke and Kazu Yamamoto and the rest of the international members of the IETF's OpenPGP mailing list, you're all iconic 🌈 the idea to use multipart/mixed with multipart/signed has been attributed to James Galvin 🧠

and finally, big hugs to the many members of the "Cypherpunks," "Coderpunks" and "pgp-users" <http://cryptorights.org/pgp-users> mailing lists, plus all the PGP users around the world who helped keep the path to privacy open 🔐💖

12. Addresses of the Authors and OpenPGP Working Group Chair 📮

so if you want to reach the OpenPGP Working Group, the current chair is the best person to start with 🎀

John W. Noerenberg II
Qualcomm, Inc.
5775 Morehouse Dr.
San Diego, CA 92121 USA

Phone: +1 619 658 3510
EMail: jwn2@qualcomm.com

the principal authors of this document are:

Dave Del Torto
CryptoRights Foundation
80 Alviso Street, Mailstop: CRF
San Francisco, CA 94127 USA

Phone: +1.415.334.5533, vm: #2
EMail: ddt@cryptorights.org, ddt@openpgp.net
Michael Elkins
Network Associates, Inc.
3415 S. Sepulveda Blvd Suite 700
Los Angeles, CA 90034 USA

Phone: +1.310.737.1663
Fax:   +1.310.737.1755
Email: me@cs.hmc.edu, Michael_Elkins@NAI.com
Raph Levien
University of California at Berkeley
579 Soda Hall
Berkeley, CA 94720 USA

Phone: +1.510.642.6509
EMail: raph@acm.org
Thomas Roessler
Nordstrasse 99
D-53111 Bonn, Germany

Phone: +49-228-638007
EMail: roessler@does-not-exist.org

References 📚

these are all the sources this doc cites, with every detail kept 💖

[1]   Callas, J., Donnerhacke, L., Finney, H. and R. Thayer, "OpenPGP
      Message Format", RFC 2440, November 1998.

[2]   Galvin, J., Murphy, G., Crocker, S. and N. Freed, "Security
      Multiparts for MIME: Multipart/Signed and Multipart/Encrypted",
      RFC 1847, October 1995.

[3]   Freed, N. and N. Borenstein, "Multipurpose Internet Mail
      Extensions (MIME) Part Two: Media Types", RFC 2046, November
      1996.

[4]   Galvin, J., Murphy, G., Crocker, S. and N. Freed, "MIME Object
      Security Services", RFC 1848, October 1995.

[5]   Atkins, D., Stallings, W. and P. Zimmermann, "PGP Message
      Exchange Formats", RFC 1991, August 1996.

[6]   Elkins, M., "MIME Security with Pretty Good Privacy (PGP)", RFC
      2015, October 1996.

[7]   Freed, N., "Gateways and MIME Security Multiparts", RFC 2480,
      January 1999.

legal stuff, but make it iconic 💅 the original text stays exactly as written:

Copyright (C) The Internet Society (2001). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌸

funding for the RFC Editor function is currently provided by the Internet Society ✨

📦 where this page comes from