Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Justus Winter <[e-mail]>]

Andrew Gallagher <andrewg=[e-mail]> writes:

> On 01/03/2023 18:01, Daniel Kahn Gillmor wrote:
>> On Wed 2023-03-01 12:46:26 +0000, Andrew Gallagher wrote:
>>> The body of a signature packet contains the prefix octets, and the above
>>> only says to remove the unhashed subpacket area. So fixing up the prefix
>>> octets will invalidate 0x50 sigs.
>> 
>> I think this is correct, but surely "do not tamper with the subject of a
>> signature if you want the signature to still validate" is true
>> *regardless* of whether the subject of the signature is itself an
>> OpenPGP signature or not.
>> 
>> Why should the working group prohibit an implementation that wants to
>> fix a malformed certification that is *not* covered by a 0x50 signature
>> or embedded in a digest-dependent chain like a git repo?
>
> Because in a distributed system you don't know that a signature is not 
> the subject of a countersignature or digest somewhere else. We can 
> easily construct a case where a signature is stored on some central 
> system (e.g. a keyserver), and also distributed to a third party (or 
> parties) for countersignature. When a countersig comes back, what 
> happens if the original sig has been fixed up in the meantime? Does the 
> keyserver refuse to process the countersig (being invalid) or does it 
> revert to the previous (malformed) version? What if one third party 
> countersigs the malformed sig and another countersigs the fixed-up copy?
>
> This is a can of worms that should be nailed firmly shut IMO.

While this is true, I fear that we're having an argument for the sake of
having an argument.

You indeed found a place where hashing in the OpenPGP sense does cover
the digest prefix.  However, I'm not aware of an implementation of
third-party confirmation signatures, or even a clear cut use case, and I
haven't seen such a signature, neither in the wild nor in test data.

(Attestation Key Signatures also seem to hash the digest, and I have
actually implemented that, but noone else has AIUI, and Attestation Key
Signatures have been deemed unchartered, so they are not really a
thing.)

I don't think either warrants a clarification for v4 (let alone v3)
signatures.

Best,
Justus