Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Daniel Kahn Gillmor <[e-mail]>]

On Thu 2023-03-02 13:36:57 +0000, Andrew Gallagher wrote:
> It does not matter whether you think RFC4880 allowed lenient behaviour 
> or not. What matters is that enough other people thought that it did, so 
> there are now permanent facts on the ground that you are powerless to 
> undo. Neither of us LIKE this scenario. I'm just not prepared to punish 
> github users for a historical error that a) they had no hand in, b) has 
> no known security implications, and c) nobody, not even github 
> themselves, can now fix.

To be fair, Github *can* fix their v4 signatures and their certificates
going forward.  It does not appear that they have done so.

Surely there are invalid OpenPGP signatures (not just malformed due to a
bad digest prefix) scattered throughout git repositories everywhere just
because people make mistakes (or the keys that issued them are now
revoked, etc) and modification-aware systems like git don't really let
people undo things of this nature.

Having some implementations that are strict about v4 signatures might
provide some pressure on Github to correct their signatures (and their
public key) going forward, and if the result is that those
implementations can't (or won't) validate legacy signatures, that's just
a larger pool of invalid signatures for those implementations.

> I withdraw my proposal.

Can we get a consensus read from the group about whether the proposal as
it stands in !213 is acceptable?

The proposal adds this single sentence to the crypto-refresh:

    When verifying a v6 signature, an implementation MUST reject the
    signature if these octets don't match the first two octets of the
    computed hash.

I'm not asking for a consensus about whether this is *everything* you'd
like to see (this conversation has made it clear to me that there are
strongly-held opinions within the group about desired-yet-conflicting
additional clarifications about v3 and v4 signatures).

I'm asking whether you approve of this particular addition, as it
stands.  I don't think i've heard any objections from the group about
mandating this strictness for v6 signature verifications.

Please send a short note if you approve.  If you don't approve, please
let the list know; and if you could explain your objection, that would
be great too.

          --dkg