Re: [openpgp] Definition of Subkey Revocation Signatures

[Daniel Huigens <[e-mail]>]

Hey Paul,

Yeah, actually I remember this confusing me as well. Both OpenPGP.js and gopenpgp hash both the primary key and subkey, as you said.

Best,
Daniel

------- Original Message -------
On Thursday, May 11th, 2023 at 10:53, Paul Schaub <[e-mail]> wrote:

> Hey!
>
> While hacking around I discovered, that there was a discrepancy between my implementation and rfc4880 that surprised me.
>
> https://www.rfc-editor.org/rfc/rfc4880#section-5.2.1 states for section 0x28:
>
>> 0x28: Subkey revocation signature
>>        The signature is calculated directly on the subkey being revoked.
>>        [...]
>
> In my code, I calculated the signature over the primary key and the subkey instead.
>
> The descriptions for binding signature types 0x18 and 0x19 explicitly stated that the signature would be generated over the primary key and the subkey:
>
>> 0x18: Subkey Binding Signature
>>        [...] This signature is calculated
>>        directly on the primary key and subkey, and not on any User ID or
>>        other packets. [...]
>>
>>    0x19: Primary Key Binding Signature
>>        [...] This signature
>>        is calculated the same way as a 0x18 signature: directly on the
>>        primary key and subkey, and not on any User ID or other packets.
>
> Since I haven't had any interoperability problems with other implementations with regards to subkey revocations in the past, I suspect that most implementations did not follow the spec to the word either and did how I did.
>
> Therefore I proposed a patch that brings the wording of 0x28 signatures in line with 0x18 and 0x19: https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/307
>
> Paul