Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Andrew Gallagher <[e-mail]>]

On 26/02/2023 14:30, Daniel Kahn Gillmor wrote:
> Hi OpenPGP folks--
> 
> one more question about an outstanding merge request, which i missed in
> my earlier review:
> 
> https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/213 proposes
> adding a single sentence to the "Notes on Signatures" subsection about
> the two octets of hash prefix that are embedded in an OpenPGP signature:
> 
>         An implementation MUST reject signatures where these octets don't
>         match the first two octets of the computed hash.

...

> Alternatively, we could be even more conservative and apply this
> requirement *only* to v6 signatures, leaving untouched the ambiguity in
> verification for v3 and v4 signatures.

IMO the check should be mandatory for v6 signatures. If we are keeping 
the prefix octets in v6, they MUST be meaningful. But I am not happy 
with retaining the current ambiguity for v3/4 sigs. v4 sigs in 
particular will be around for a long time to come, so we have an 
obligation to address the well-known interop problems.

Given that there are a significant number of non-conformant historical 
sigs in the wild, it is wrong to mandate a stricter interpretation in 
retrospect. Signatures that were previously considered valid (even if 
only by some implementations) should only be retrospectively invalidated 
in the event of a security vulnerability, and there is no suggestion 
that this ambiguity could be exploited to make an invalid signature 
appear valid. This is an interop issue, not a security one, so IMO the 
least problematic solution is to be lenient in what we accept.

I therefore propose that we modify !213 to insert "v6" before 
"signatures" and also append the following text:

```
An implementation SHOULD NOT reject v3 or v4 signatures where these 
octets don't match the computed hash but the signature is otherwise 
valid. An implementation MAY use the high octets from v3 and v4 
signatures for performance optimisation.
```

I can open an alternative MR if required.

A