[openpgp] Backwards compatibility vs streaming verification of v6 clearsigned messages

[Daniel Huigens <[e-mail]>]

Hi all,

(The following question came up in [!309], but I thought it might be
worth bringing to the list.)

In OpenPGP.js and GopenPGP, cleartext signed messages with header names
other than "Hash" are rejected. The reason is to prevent messages like:

    -----BEGIN PGP SIGNED MESSAGE-----
    Reminder: I need you to wire $100k to 12345566 as soon as possible.

    Thank you!
    -----BEGIN PGP SIGNATURE-----
    [...]

from being able to trick a user into thinking the entire message was
signed.

These checks were introduced after security audits by [Cure53] and
[SEC Consult] pointed out the issue in OpenPGP.js and Go's x/crypto
respectively, with the latter even getting a [CVE] assigned to it.

V6 cleartext signed messages introduce a "SaltedHash" header, since v6
signatures include a salt at the start of the hashing context; so it's
necessary to know the salt in advance if you want to verify the message
in one pass (without buffering the cleartext).

But, this means that cleartext signed messages that are signed using
both a v4 and a v6 signature won't be backwards compatible, at least
for OpenPGP.js and GopenPGP.

I don't think this is a huge showstopper because clearsigned messages
are anyway not the preferred way of signing messages, and we can update
OpenPGP.js and GopenPGP relatively easily to also allow the "SaltedHash"
header.

That being said, I'm also not sure streaming verification of clearsigned
messages (without buffering) is super important, since they're likely to
be small? So maybe it would be better to drop the header, or drop it for
mixed messages (with both v4 and v6 signatures)?

In any case, I don't have a super strong opinion about this, but I'm
curious to hear what the WG thinks. I can make a MR if there seems to
be consensus on this one way or another.

And, apologies for bringing this up so late!

Best,
Daniel


[!309]: https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/309#note_1396560093
[Cure53]: https://github.com/openpgpjs/openpgpjs/wiki/Cure53-security-audit
[SEC Consult]: https://seclists.org/fulldisclosure/2019/May/16
[CVE]: https://nvd.nist.gov/vuln/detail/CVE-2019-11841