Re: [openpgp] Backwards compatibility vs streaming verification of v6 clearsigned messages

[Vincent Breitmoser <[e-mail]>]

Hey list,

> Does anyone want to propose a fifth option that the WG should consider?
> Anyone want to voice a preference for any of the above four options?

I got one:

# Drop CSF headers altogether

CSF headers are pointless to the user at best, confusing or misleading 
at worst. They are easily mangled along transports in ways that break 
the signed message. We are also now in a situation where implementations 
say "there must be exactly this one header, or we won't process the 
message altogether".

That's three bits of being problematic, so we better have a 
justification for having it in the first place: That justification is 
efficient processing. Similar to one-pass signatures, we can hash the 
message right away and therefore verify the signature in a single pass.

While that is for sure a nice technical property to have, I find it 
questionable that CSF signed messages need any kind of "efficient" 
processing by today's computing standards - they are meant to be easy 
for humans to inspect and pass around, so will typically be a few 
kilobytes in size or maybe a megabyte at most. It will routinely be 
loaded into RAM in its entirety to display to users.

Getting rid of the whole header discussion altogether, at the expense of 
less efficient processing, sounds like a good deal to me. Maybe slap on 
a notice that implementations should warn the user not to use it for 
500kb+ messages or so.

That said, I'm not sure whether such a change is in scope for a 
crypto-refresh. But I thought I'd put it on the table, if just for 
completeness' sake.

Cheers

  - V