Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Justus Winter <[e-mail]>]

Daniel Kahn Gillmor <[e-mail]> writes:

>> It MUST NOT modify such malformed signatures.
>
> Where does this constraint come from?  Why is it here?

I'm also very skeptical of this requirement.  Andrew, in your mail you wrote:

>> This is more or less a statement of current reality, with an added
>> prohibition against invalidating any checksum over the signature
>> packet.

Note that checksum over signatures in the OpenPGP sense do neither
include the digest prefix nor the unhashed subpacket area.

Any code that relies on signatures not changing their on-wire
representation is likely wrong.  If you checksum or compare signatures,
you must exclude information not covered by the OpenPGP hash, like the
unhashed subpacket area and the packet framing.  The unhashed subpacket
area is there for the sole purpose of being able to add information to
the signature after the fact (or strip them, or reorder them).  You
cannot rely on others not doing that.

Best,
Justus