Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Paul Schaub <[e-mail]>]

!213 sounds sensible to me.

Paul

Am 2. März 2023 15:09:00 MEZ schrieb Daniel Kahn Gillmor <[e-mail]>:
>On Thu 2023-03-02 13:36:57 +0000, Andrew Gallagher wrote:
>> It does not matter whether you think RFC4880 allowed lenient behaviour 
>> or not. What matters is that enough other people thought that it did, so 
>> there are now permanent facts on the ground that you are powerless to 
>> undo. Neither of us LIKE this scenario. I'm just not prepared to punish 
>> github users for a historical error that a) they had no hand in, b) has 
>> no known security implications, and c) nobody, not even github 
>> themselves, can now fix.
>
>To be fair, Github *can* fix their v4 signatures and their certificates
>going forward.  It does not appear that they have done so.
>
>Surely there are invalid OpenPGP signatures (not just malformed due to a
>bad digest prefix) scattered throughout git repositories everywhere just
>because people make mistakes (or the keys that issued them are now
>revoked, etc) and modification-aware systems like git don't really let
>people undo things of this nature.
>
>Having some implementations that are strict about v4 signatures might
>provide some pressure on Github to correct their signatures (and their
>public key) going forward, and if the result is that those
>implementations can't (or won't) validate legacy signatures, that's just
>a larger pool of invalid signatures for those implementations.
>
>> I withdraw my proposal.
>
>Can we get a consensus read from the group about whether the proposal as
>it stands in !213 is acceptable?
>
>The proposal adds this single sentence to the crypto-refresh:
>
>    When verifying a v6 signature, an implementation MUST reject the
>    signature if these octets don't match the first two octets of the
>    computed hash.
>
>I'm not asking for a consensus about whether this is *everything* you'd
>like to see (this conversation has made it clear to me that there are
>strongly-held opinions within the group about desired-yet-conflicting
>additional clarifications about v3 and v4 signatures).
>
>I'm asking whether you approve of this particular addition, as it
>stands.  I don't think i've heard any objections from the group about
>mandating this strictness for v6 signature verifications.
>
>Please send a short note if you approve.  If you don't approve, please
>let the list know; and if you could explain your objection, that would
>be great too.
>
>          --dkg