Subject: [openpgp] Intended Recipient Fingerprint signature subpacket
From: Vincent Breitmoser <[email-masked]>
To: [email-masked]
Date: Tue, 6 Mar 2018 00:19:51 +0100
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>

Hey folks,

dkg and I have been discussing an "Intended Recipient Fingerprint"
subpacket, that pins a signature to be valid only in an encrypted
context to the indicated recipient.

Use of this subpacket removes some wiggling room for signed+encrypted
messages.  This can be used to prevent replay attacks, where a signature
is taken out of its context and forwarded to a different recipient.

Please see https://0xacab.org/schleuder/schleuder/issues/158 for a
complete description of an attack scenario in the context of the
Schleuder remailer.  The given scenario is solved with this subpacket on
the openpgp layer.

Diff attached for rfc4880bis, please comment.

 - V

diff --git a/middle.mkd b/middle.mkd
index f09d85f..373aca2 100644
--- a/middle.mkd
+++ b/middle.mkd
@@ -1058,6 +1058,7 @@ The value of the subpacket type octet may be:
           32   Embedded Signature
           33   Issuer Fingerprint
           34   Preferred AEAD Algorithms
+          35   Intended Recipient Fingerprint
   100 to 110   Private or experimental
 
 An implementation SHOULD ignore any subpacket of a type that it does
@@ -1662,6 +1663,19 @@ signature, the key ID of the Issuer subpacket MUST match the low
 Note that the length N of the fingerprint for a version 4 key is 20
 octets; for a version 5 key N is 32.
 
+#### Intended Recipient Fingerprint
+
+(1 octet key version number, N octets of fingerprint)
+
+The OpenPGP Key fingerprint of the intended recipient primary key.  If
+one or more subpackets of this type are included in a signature, it
+SHOULD be considered valid only in an encrypted context, where the key
+it was encrypted to is one of the indicated primary keys, or one of
+their subkeys.  This can be used to prevent forwarding a signature
+outside of its intended, encrypted context.
+
+Note that the length N of the fingerprint for a version 4 key is 20
+octets; for a version 5 key N is 32.
 
 ### {5.2.4} Computing Signatures