Re: Outstanding question - rule on cleartext signing last line

[Ian G <[e-mail]>]

David Shaw wrote:
> As far as I can see, the current system is quite reversible.  For
> example, given a document reading "this is a test" (no line ending,
> and the last character in the file is the second t from test), here's
> a clear signature:

OK, I understand all that.  But you've added
a new rule:  on signing, always add the extra
line ending.

And that's what we want to clarify - I don't
think the spec says that.  It simply says that
the last newline is not part of the signature.

By all means, if that's what we agree on, then
we should simply state that in the spec:  always
add a newline on signing, always take it off
on reversing (verifying and stripping sig).

I'm happy with that rule - even though I don't
think that's what all implementations do.

> The final CRLF is not part of the document.  If a user/implementation
> wants a final CRLF in there that is part of the document, they need to
> add one.
> 
> Think of the "BEGIN PGP SIGNATURE" string as actually being
> "CRLF-----BEGIN PGP SIGNATURE".  It's part of the message structure
> and not part of the signed text.

Right that all makes perfect sense - to me.
Can we put that in the spec?  Here's what it
says:

     As with binary signatures on text documents, a cleartext signature
     is calculated on the text using canonical <CR><LF> line endings.
     The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
     SIGNATURE-----' line that terminates the signed text is not
     considered part of the signed text.

     When reversing dash-escaping, an implementation MUST strip the
     string "- " if it occurs at the beginning of a line, and SHOULD warn
     on "-" and any character other than a space at the beginning of a
     line.

     Also, any trailing whitespace -- spaces (0x20) and tabs (0x09) -- at
     the end of any line is removed when the cleartext signature is
     generated.

Here's what I suggest (changes at ***):

     As with binary signatures on text documents, a cleartext signature
     is calculated on the text using canonical <CR><LF> line endings.
     The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
     SIGNATURE-----' line that terminates the signed text is not
*** part of the signed document and SHOULD be added by implementations. ***

     When reversing dash-escaping, an implementation MUST strip the
     string "- " if it occurs at the beginning of a line, and SHOULD warn
     on "-" and any character other than a space at the beginning of a
     line.

     Also, any trailing whitespace -- spaces (0x20) and tabs (0x09) -- at
     the end of any line is removed when the cleartext signature is
     generated.

How's that?

iang