[openpgp] Proposal for update to RFC3156 (PGP/MIME)

[Andrew Gallagher <[e-mail]>]

Hi, all.

We have previously discussed the possibility of updating RFC3156 to support v6 signatures. One particular concern is how to add the salt to the MIME header, but there is also the (long-standing) question of how to make PGP/MIME messages render more elegantly in naive clients (i.e. without displaying an unknown attachment).

It occurred to me that since the `micalg` parameter in the `Content-type: multipart/signed` specification is fully protocol-specific, we can choose to put anything we want in there. And the easiest way to make it version-agnostic is to replace the digest algorithm name with an armored OpenPGP packet.

If we used an OPS packet, it would look like (using the v6 test vector from RFC9580):

```
Subject: OPS test vector
Content-Type: multipart/signed;
 boundary="12345678”;
 protocol="application/pgp-signature”;
 micalg="pgp-ops:
  xEYGAQobIHZJX1AhiJD39eLuPBgiUU9wUA9VHYblySHkBONKU/usyxhsTwYJppfk
  1S36bHIrDB8eJ8GKVnCPZSXsJ7rZrMkB"

--12345678
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
    charset=utf-8

...
```

Alternatively, we could place the *signature* packet in the headers:

```
Subject: Prefix test vector
Content-Type: multipart/signed;
 boundary="12345678”;
 protocol="application/pgp-signature”;
 micalg="pgp-sig:
  wpgGARsKAAAAKQWCY5ijYyIhBssYbE8GCaaX5NUt+mxyKwwfHifBilZwj2Ul7Ce6
  2azJAAAAAGk2IHZJX1AhiJD39eLuPBgiUU9wUA9VHYblySHkBONKU/usJ9BvuAqo
  /FvLFuGWMbKAdA+epq7V4HOtAPlBWmU8QOd6aud+aSunHQaaEJ+iTFjP2OMW0KBr
  NK2ay45cX1IVAQ=="

--12345678
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8

…
```

The trailing signature MIME part is then redundant, however the multipart/signed spec requires one. So by analogy with multipart/encrypted we could add a fake “inline signature” MIME part, that PGP-aware MUAs could handle gracefully:

```
--12345678
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline

This is an OpenPGP signed message. You need an OpenPGP-aware client to verify the signature.

--12345678--
```

Daniel Huigens and I have tested by roundtripping both these constructions through postfix, Gmail and Protonmail -- they survived intact, and also displayed prettily. I haven’t tested whether a PQC-sized prefix signature header would survive such a roundtrip today, however support for such large headers would surely have to be implemented for ARC and DKIM signatures at some point. The OPS construction has the advantage that it will definitely work with PQC now, and the prefix construction has the advantage that it is pretty. Both have the advantage that the micalg parameter and the two MIME parts could be concatenated and streamed directly into the OpenPGP library with minimal pre-processing by the MUA.

Thoughts?

A