Re: [openpgp] Should signatures be rejected if the embedded hash prefix does not match?

[Paul Wouters <[e-mail]>]

On Thu, 2 Mar 2023, Daniel Kahn Gillmor wrote:

> Can we get a consensus read from the group about whether the proposal as
> it stands in !213 is acceptable?
>
> The proposal adds this single sentence to the crypto-refresh:
>
>    When verifying a v6 signature, an implementation MUST reject the
>    signature if these octets don't match the first two octets of the
>    computed hash.
>
> I'm not asking for a consensus about whether this is *everything* you'd
> like to see (this conversation has made it clear to me that there are
> strongly-held opinions within the group about desired-yet-conflicting
> additional clarifications about v3 and v4 signatures).
>
> I'm asking whether you approve of this particular addition, as it
> stands.

(no hats on)

I am in favour of adding this, so as to try and prevent the current
existing problem in v3/v4 sigs from becoming a problem in v6 sigs.

Paul