Re: [openpgp] changing the trailer for hashed data in v5 OpenPGP signatures

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2022-11-22 18:33:05 +0000, Daniel Huigens wrote:

> Yeah, I think your analysis is correct. And I also prefer just leaving
> the length at 4 octets rather than the workaround of splitting up the
> length into 2 x 4 octets.

I'll try to make an MR proposing this change, but if someone else
decides to beat me to it i wouldn't object.

> I do think that, for robustness and to prevent similar issues in the
> future, it may make sense to hash the signature version at the
> beginning, in addition to the end. That way, in v7(?), we would be free
> to change the trailer without such considerations, if we wanted.
> (We'd have to make sure that you can always tell from the one-pass
> signature packet or armor headers which version it is, though.)
> But, maybe it's a bit late for that change / not worth it, we can also
> leave it.

We have an existing invariant, which is that the version-differentiator
octets are at a fixed offset from the end. (assuming we adopt one of
the two fixes under discussion).

The versions described in the crypto-refresh are the first version that
explicitly binds key versions to signature versions.  v4 keys have
historically made v3 signatures, even though i'm unaware of any good
reason to permit that.  That means that there's a risk of cross-version
signature stream aliasing without careful adjustments, as observed by
Demi Marie Obenour.

I think as long as we can establish in this release that v5 keys MUST
only generate v5 sigs, and v4 keys MUST NOT generate v5 sigs, that
prepares us to relax a little bit less about signature aliasing for
future versions, where we could move fixed-position distinguishing
fields to the front of the hashed sequence.  But i am not sure we want
to try to establish this change now.

(i do think that when we've stabilized these new-version signatures and
keys, we'll want to use the interop test suite to ensure that
implementations don't accept v5 sigs from v4 keys, or v4 sigs from v5
keys, to ensure that those versions are well-isolated)

        --dkg