Re: [openpgp] Backwards compatibility vs streaming verification of v6 clearsigned messages

[Justus Winter <[e-mail]>]

Vincent Breitmoser <look=[e-mail]> writes:

> Hey list,
>
>> Does anyone want to propose a fifth option that the WG should consider?
>> Anyone want to voice a preference for any of the above four options?
>
> I got one:
>
> # Drop CSF headers altogether
>
> CSF headers are pointless to the user at best, confusing or misleading 
> at worst. They are easily mangled along transports in ways that break 
> the signed message. We are also now in a situation where implementations 
> say "there must be exactly this one header, or we won't process the 
> message altogether".
>
> That's three bits of being problematic, so we better have a 
> justification for having it in the first place: That justification is 
> efficient processing. Similar to one-pass signatures, we can hash the 
> message right away and therefore verify the signature in a single pass.
>
> While that is for sure a nice technical property to have, I find it 
> questionable that CSF signed messages need any kind of "efficient" 
> processing by today's computing standards - they are meant to be easy 
> for humans to inspect and pass around, so will typically be a few 
> kilobytes in size or maybe a megabyte at most. It will routinely be 
> loaded into RAM in its entirety to display to users.
>
> Getting rid of the whole header discussion altogether, at the expense of 
> less efficient processing, sounds like a good deal to me. Maybe slap on 
> a notice that implementations should warn the user not to use it for 
> 500kb+ messages or so.

We talked about this at the OpenPGP email summit, and we agreed that
this is a good solution.  I have created a merge request where we can
fine-tune the change:

https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/313

Best,
Justus