Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Andrew Gallagher <[e-mail]>]

On 01/03/2023 11:42, Justus Winter wrote:
> Note that checksum over signatures in the OpenPGP sense do neither include the digest prefix nor the unhashed subpacket area.

According to the current draft:

```
When a signature is made over a Signature packet (type 0x50, 
"Third-Party Confirmation signature"), the hash data starts with the 
octet 0x88, followed by the four-octet length of the signature, and then 
the body of the Signature packet. (Note that this is a Legacy packet 
header for a Signature packet with the length-of-length field set to 
zero.) The unhashed subpacket data of the Signature packet being hashed 
is not included in the hash, and the unhashed subpacket data length 
value is set to zero.
```

The body of a signature packet contains the prefix octets, and the above 
only says to remove the unhashed subpacket area. So fixing up the prefix 
octets will invalidate 0x50 sigs.

A