Re: [openpgp] change salt size for v5 signatures?

[Daniel Kahn Gillmor <[e-mail]>]

On Sun 2023-02-05 12:17:58 -0500, Daniel Kahn Gillmor wrote:
> v5 signatures are currently 16 octets.  Should we update this to be able
> to accomodate some future schemes that probably warrant more than 16
> octets of salt?  (see
> https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/150)
>
> Some interesting subquestions:
>
> - Should this be a uniform increase to 32 octets?  or should it be bound
>   to the hash function used?
>
> - If variable-sized, should the size of the salt be indicated on the
>   wire in the Signature packet?
>
> An MR that answers "bound to the hash function used" and "indicated on
> the wire" to the above questions:
> https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/219

We discussed this in the interim session today.  The consensus of the
active participants was that we should make this change.  In particular:

 - to bind the salt size to the hash algorithm used for the signature,
   adding a column to the table of hash algorithms

 - to indicate the size of the salt on the wire, which permits parsing
   signature packets even when the hash algorithm is unknown

 - to reject v6 signatures when their salt size does not match the
   expected salt size for their hash algorithm

 - to indicate that the expected salt size for deprecated hash
   algorithms like MD5 and SHA1 should be "N/A"

Daniel Huigens offered to make an MR on top of !219 that adopts this
last change.

    --dkg