[openpgp] Re: Problem in RFC 9580

[Peter Gutmann <[e-mail]>]

Andrew Gallagher <andrewg=[e-mail]>writes:

>Quietly? It was discussed at IETF114:

You expect people to plough through pages and pages of meeting minutes? :-).

>It ensures that there is only one way to encode an MPI on the wire, and it
>was introduced to prevent the further recurrence of issues where an MPI is
>parsed and reserialised, and the reserialisation breaks the signature. GitHub
>did this to multiple keys.

Given all the other breakage in GitHub's stuff, e.g. the broken hash prefix,
I'd say there are bigger problems there... also, is there really PGP code that
re-serialises a signature and expects it to still verify?  The same mistake
the X.509 folks made, and thankfully fixed, in the early 1990s?  Was it the
same GitHub code that did that?

(I would say that this breakage is actually a feature, because it tells you
not to try reserialising signed data.  This "fix" is fixing the wrong thing,
it's making doing the wrong thing slightly less wrong rather than addressing
the actual cause of the wrongness).

>Such an MPI has *never* been valid. The following text has been in the spec
>since RFC2440 (section 3.2
>https://datatracker.ietf.org/doc/html/rfc2440#section-3.2):

Hmm, who knew?  I've been encoding bit lengths as ( byte length * 8 ) for 30+
years and never had any complaints.  Having said that, I've also never tried
to reserialise signed data because it doesn't work, so both bit-length-encoded
and byte-length-encoded signed data will verify fine.  As will any other 
encoding an implementation chooses to produce.

Peter.