Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Andrew Gallagher <[e-mail]>]

On 01/03/2023 18:01, Daniel Kahn Gillmor wrote:
> On Wed 2023-03-01 12:46:26 +0000, Andrew Gallagher wrote:
>> The body of a signature packet contains the prefix octets, and the above
>> only says to remove the unhashed subpacket area. So fixing up the prefix
>> octets will invalidate 0x50 sigs.
> 
> I think this is correct, but surely "do not tamper with the subject of a
> signature if you want the signature to still validate" is true
> *regardless* of whether the subject of the signature is itself an
> OpenPGP signature or not.
> 
> Why should the working group prohibit an implementation that wants to
> fix a malformed certification that is *not* covered by a 0x50 signature
> or embedded in a digest-dependent chain like a git repo?

Because in a distributed system you don't know that a signature is not 
the subject of a countersignature or digest somewhere else. We can 
easily construct a case where a signature is stored on some central 
system (e.g. a keyserver), and also distributed to a third party (or 
parties) for countersignature. When a countersig comes back, what 
happens if the original sig has been fixed up in the meantime? Does the 
keyserver refuse to process the countersig (being invalid) or does it 
revert to the previous (malformed) version? What if one third party 
countersigs the malformed sig and another countersigs the fixed-up copy?

This is a can of worms that should be nailed firmly shut IMO.

A