Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Daniel Huigens <[e-mail]>]

Hi all,

On Monday, February 27th, 2023 at 23:12, Justus Winter wrote:
> Anyway, I think we made our points, I'll let someone else chime in.

I don't have a super strong opinion on this point but I'll take this
prompt as a cue to voice one anyway:

Our implementations (OpenPGP.js and gopenpgp) do reject signatures
with incorrect digest prefixes, and I have a slight preference towards
keeping that check. When debugging, it gives an indication about whether
the hashed data was wrong, or whether the signing process itself was
broken, for example. That being said, it's still possible to check that
manually, it's just a bit more of a hassle. If broken signatures are
widespread, I would be OK with removing the check for v4 signatures,
and checking it only for v6 sigs; or we could add a config option.

That being said, we haven't encountered many issues with this check in
the wild in an email context. But I guess in the context of git commit
signatures this can be considered more widespread.

>From a spec perspective, it's then difficult to mandate this check for
v4 signatures across the board; any implementation that has to deal
with GitHub's signatures (and GitHub itself) will probably not comply
with that requirement. So maybe requiring it only for v6 makes sense.

I've updated [!213] to reflect that, also because I assume it'll be
easier to reach consensus on that.

Best,
Daniel

[!213]: https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/213