Re: [openpgp] Backwards compatibility vs streaming verification of v6 clearsigned messages

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2023-05-24 15:40:11 +0200, Vincent Breitmoser wrote:

> # Drop CSF headers altogether

Thanks for this proposal, Vincent.  I think it is mostly equivalent to
the "Drop SaltedHash" proposal, with the added benefit of mildly
discouraging the Hash: header itself (we can't say "MUST NOT generate"
absolutely because implementations want legacy clients to be able to
validate).  I was initially quite wary of this approach, but seeing the
discussion on-list and thinking through all the options, i think it's
the best one.

We'd basically be telling interpreting implementations that they should
ignore any Hash header (otherwise we'd break interoperability with CSF
messages from old clients), and telling generating implementations that
they need not emit a Hash header at all for messages with v4 signatures.

Another way of framing this argument is that CSF is designed for data
that a human will look at and make sense of directly.

if the CSF message itself is too large to fit into RAM, it is certainly
too large for a human to hold in their understand or hold in their mind
as well, which means it's a poor candidate for CSF in the first place.
So a streaming interface shouldn't be necessary.

RFC 4880 said that previous clearsigned messages without a Hash: header
used MD5 (this appears to be historical RFC 1991 mechanism).  Since
we're already saying that signatures made over MD5 shouldn't be
validated due to the weakness of the digest, there isn't even a semantic
collision.

Furthermore, existing implementations are brittle even about the Hash:
header itself.  For example, many implementations will reject a CSF
message that indicates that one of the embedded signatures uses a novel
hash algorithm (you can try this by swapping out "Hash: SHA256" for
"Hash: SHA256,Bananas", or even "Hash: SHA256,SHA3_256" for an
implementation that doesn't yet know about SHA3.

So the "Hash:" armor header:

 - Appears to be valuable only in providing a streaming interface for
   CSF verifiers

 - Is brittle in existing implementations

 - Is distracting/confusing to humans who try to read a message in its
   plaintext form

Seems like a good reason to drop it.

> https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/313

This proposal is a reasonable implementation of this approach.

I've added a few comments there, in particular suggesting:

 - That we indicate that the Hash: header is deprecated.

 - That we describe the circumstances where an implementation might want
   to actually emit a Hash: header (when the CSF message contains a v4
   sig over a sha2 digest)

 - That we direct validators to ignore any Hash: header in a CSF message

if folks think any of these concrete recommendations are problematic,
please speak up.

 --dkg