Subject: Re: Authenticated command execution?

From: Adam Shostack <[email-masked]>
Date: Wed, 19 Oct 94 17:45:26 EDT

-----BEGIN PGP SIGNED MESSAGE-----

Rick asked:

| This is somewhat related to the recent ``FAQ? and a question'' thread.
|
| Has anyone done anything to use PGP to support authenticated command
| execution?

	Actually, its very related.  I was hacking at it earlier this
afternoon because of the number of authentication related questions we
had.

	(For those who don't know, PGP is Pretty Good Privacy, a
strong public key encryption program.)

| I would like to be able to execute accept a PGP message signed by a
| very trusted key (probably only my own) and encrypted to my key,
| decrypt the message, execute the contents as a script, sign and
| encrypt the output, and use the result as the body of a reply to the
| original message.

	How do you keep your passphrase safe?  You could use a
seperate (low security key) and read in the passphrase from a file in
a protected directory, but that only protects you from users on the
system.  root@localhost can still muck things up, pretend to be your
low security key.  This may be acceptable to you, or it may not.

| Has anyone done this already?  If so, are you willing to share your
| implementation and/or discuss problems that you encountered along the
| way?

	I ran into PGP throwing its output around in weird ways.  I
wasn't able to easily seperate out the real information (Good
signature from...) to see if I wanted to act on the message.  I think
the solution is a one shot utility called authentic(1)- see if its
input has a good signature.

authentic [email-masked]
would return a 0 if the mail is from [email-masked], a 1 otherwise.

:0:  # Maybe this should be ? !authentic
? authentic [email-masked]
| lpr

would allow me to print signed documents.

Adam

---

From: Rick Busdiecker <[email-masked]>
Date: Wed, 19 Oct 1994 23:20:37 -0400

From: Adam Shostack <[email-masked]>
    Date: Wed, 19 Oct 94 17:45:26 EDT

This sounds in line with what I had in mind.  I want to use this to
send a command in from outside a firewall and I expect to have a key
dedicated to this purpose.  The main use would be so that I could log
in as [email-masked] and send a message to [email-masked].  The key only
needs to provide very light-weight security -- I could just send
clearsigned commands and plaintext results without any key at all.
The authentication is what I see as the more important aspect, i. e. I
want to strictly limit who can cause the command(s) to be executed.
As to attacks from within the firewall, they're not a concern for me
in this context.
    
    I think the solution is a one shot utility called authentic(1)-
    see if its input has a good signature.

This sounds like a reasonable approach.
    
    authentic [email-masked]

This seems ok, but it should probably also accept something like:
 % authentic 0xDBD9994D
as I'm more concerned with the signature being from the right key than
I am with the address -- I can imagine a situation where I might want
to use a PC to compose the command message and ask a friend to mail it
for me and then decrypt the results on a PC.
    
Thanks for sharing your thoughts on this.

			Rick