Subject: Cleartext Signatures

From: Ben Laurie <[email-masked]>
Date: Mon, 10 Oct 2005 11:43:05 +0100

Section 7 says that the last bit of a cleartext signature is:

"The ASCII armored signature(s) including the '-----BEGIN PGP 
SIGNATURE-----' Armor Header and Armor Tail Lines."

This is ambiguous, since in previous sections "Armor Header" has 
referred to name/value pairs, of which there could be none or more than 
one, and not the "-----blah-----" line, which is called the "Armor 
Header Line".

Since I have seen signature both with and without headers (i.e. some 
with no headers do not have a blank line between the header line and the 
armoured text), I'd like to know what is actually correct here!

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: [email-masked] (Daniel A. Nagy)
Date: Mon, 10 Oct 2005 16:27:04 +0200

> armoured text), I'd like to know what is actually correct here!

Most implementations that I have encountered or written use headers in the
signanture part of clearsigned documents and in the absence of any still
leave an empty line. I think, this is the correct behavior, though the 
"be liberal in what you accept and conservative in what you send" mantra
would imply that implementations MAY accept signatures without an empty
line, but MUST NOT generate them.

I also have a question regarding clearsigned documents. Are multiple
signatures in clearsigned documents supported by OpenPGP (the fact that
multiple hash algorithms are allowed suggests that they are)? And if so, how
exactly? I would put all of them in a single armored signature block, but
the standard does not explicitly specify this or any other method.

-- 
Daniel

---

From: Ben Laurie <[email-masked]>
Date: Mon, 10 Oct 2005 15:30:29 +0100

> line, but MUST NOT generate them.

That mantra has shown to be a less than great idea recently, since it 
promotes interestingly obscure security holes, so I still would like to 
know what the correct behaviour is, and I'd like the I-D to accurately 
document that behaviour.

Cheers,

Ben.

---

From: David Shaw <[email-masked]>
Date: Tue, 11 Oct 2005 18:11:27 -0400

On Mon, Oct 10, 2005 at 04:27:04PM +0200, Daniel A. Nagy wrote:

> signatures in clearsigned documents supported by OpenPGP (the fact
> that multiple hash algorithms are allowed suggests that they are)?
> And if so, how exactly? I would put all of them in a single armored
> signature block, but the standard does not explicitly specify this
> or any other method.

Yes, they are supported, and the putting all of them in a single
armored signature block is the way to do it.  Section 7 refers to "The
ASCII armored signature(s)" in the signature block.  The text seems
reasonably clear to me - what is not good here?

David

---

From: [email-masked] (Daniel A. Nagy)
Date: Wed, 12 Oct 2005 06:22:43 +0200

> reasonably clear to me - what is not good here?

Some details are missing. For instance, is the order salient? One-pass
signantures have to be bracketed, and clearsigned documents are supposed be
verifiable in one pass as well. But it does not necessarily imply that the
hash algorithms should be listed in reverse signature order in the
beginning. Actually, the standard says very little on how to go about it. It
would definitely help one-pass verification, if signatures that refer to
other signatures (e.g. notarization sigs) were mandated to either follow or
precede the signatures they are refering to. Both solutions have their
benefits, but deciding one way or another would be better than allowing
arbitrary order. It would be nice to have a paragraph or two elaborating on
these issues.

-- 
Daniel