[openpgp] changing the trailer for hashed data in v5 OpenPGP signatures

[Daniel Kahn Gillmor <[e-mail]>]

Hi all--

In the IETF 115 meeting, we discussed the concern that a v5 signature
could be replayed as a v3 signature across subtly different data due to
there being a simple and accidental aliasing between the trailer of the
data hashed for a v3 signature and the trailer of the data hashed for a
v5 signature.  This concern was identified by Demi Marie Obenour over
here:

   https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/130

I've written a patch to the draft to address this, but it's not ready to
be merged yet because i haven't been able to validate the existing
certificate yet (see my other message to this list from today,
Message-Id: <[e-mail]>.  So i haven't updated
the certificate with this change.  You can see the proposed change
(without the updated sample certificate) below, and in
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/220


-----

But in reviewing this, i've come across another question: do we really
need the larger trailing suffix for v5 signatures?  v4 signatures have a
four-octet suffix that is a big-endian representation for the trailer
size.  v5 signatures currently change that to eight-octets, which is is
where the v5→v3 ailiasing problem comes into play.  But this value
represents the size of the *trailer*, not the size of the message
itself.  So the increase is necessary for trailers larger than 4GiB.  Is
this necessary?

The trailer consists of:

a) one octet each of: sigversion, sigtype, pubkeyalgo, hashalgo
b) hashed subpackets length and body
c) one octet of sigversion
d) one octet of 0xff
e) size of a and b together

The only variable-length field here is the hashed subpackets.  Do we
really have a use case where the hashed subpackets will end up being so
close to 4GiB (the largest possible size due to the construction of the
v5 signature packet itself) that the four additional octets will push it
over the limit?

If my analysis is right, i think we can leave the trailer length at four
octets instead of eight for v5 signatures, which would simplify things
even further, and still solve the v5→v3 aliasing problem.

My edits in this message do *not* propose that change, but if people
here think this is sound, i'm happy to take another crack at this.

Regards,

       --dkg