Re: [openpgp] Expected client behaviour ambiguity in signature verification

[Justus Winter <[e-mail]>]

Daniel Huigens <d.huigens=[e-mail]> writes:

> On Friday, July 8th, 2022 at 13:03, Justus Winter wrote:
>
>> Sequoia uses the digest prefix as when canonicalizing certificates. If
>> we encounter a third party certification for which we don't have the
>> issuers certificate, we use the digest prefix as a heuristic to check if
>> a signature is associated with the right component, and if not, use it
>> to find the right component (with a chance of 2^16 of getting it wrong,
>> in which case we duplicate the signature).
>
> I would prefer not to (have to) do such heuristics. Signatures should be
> after the component they're associated with, and if they're not, just
> ignore them, imo. Being lenient about signature placement in this way
> can (eventually) force other implementations to do the same, similarly
> to what apparently happened with not checking the hash prefix bytes.

Are you willing to ignore a revocation just because it is in the wrong
place?

Note that this can happen even if producer of the signature and consumer
are acting correctly.  In fact, that is exactly what happened before:

  https://dev.gnupg.org/T2236

AIUI it was a SKS bug that messed up the certificate.

Best,
Justus