Re: [openpgp] text signatures

[Daniel Huigens <[e-mail]>]

Hi Neal,

Yeah, I tend to agree. I also brought this up in the MR where this
change was proposed [1], and we subsequently discussed it in the DT,
where I suggested to change the proposed text from "is encoded" to
"MUST be encoded" in order to signal that this is a new instruction
that only applies to new signatures, and that those indeed MUST be
UTF-8 encoded (which reflects the new guidance for literal data packets
in [2] to the same effect). My intention with that (not speaking for
dkg or the rest of the DT, though) was that for existing signatures,
it shouldn't apply, but actually the quoted section is general to both
signing and verification, so probably that intention isn't captured
by the final text, and it should be changed again.

Since the literal data packet already says that text data MUST be UTF-8,
maybe this guidance is redundant, in that case, and can just be removed?
We might still need some guidance for detached signatures; e.g. we could
state in section 11.4 that detached text signatures MUST be over UTF-8
encoded text (and similarly for clearsigned messages as well?)

Or, from the other direction, we could say that when creating signatures
the implementation may only set the signature type to text if it's
confident that it's signing UTF-8 encoded text?

Best,
Daniel


[1]: https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/111
[2]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-07#section-5.9