[openpgp] Re: Analysis document

Hi DKG,

Am 28.07.25 um 18:58 schrieb Daniel Kahn Gillmor:
> On Thu 2025-07-24 15:31:02 +0200, Falko Strenzke wrote:
>> I think in order to have clear instructions for the implementation of
>> the verification, an erratum would be useful. But I'm not really
>> requesting it, I'm only trying to explain how we came to classify this
>> in our document as a potential security issue. If I can help with/by
>> filing an erratum I will happily do.
> I'm still not clear how to read 9580 as mandating a re-encoding. If you
> think the text could be clearer, please do file an erratum!

In my view the following text is clearly mandating UTF-reencoding 
(relevant text porions set in bold by me) :


        /5.2.4.
        <https://www.rfc-editor.org/rfc/rfc9580.html#section-5.2.4>Computing
        Signatures
        <https://www.rfc-editor.org/rfc/rfc9580.html#name-computing-signatures>/


/All signatures are formed by producing a hash over the signature data 
and then using the resulting hash in the signature algorithm./

/When creating or verifying a version 6 signature, the salt is fed into 
the hash context before any other data.For binary document signatures 
(Type ID 0x00), the document data is hashed directly. For text document 
signatures (Type ID 0x01), the *implementation MUST first canonicalize 
the document* by converting line endings to <CR><LF> *and encoding it in 
UTF-8* (see [RFC3629 
<https://www.rfc-editor.org/rfc/rfc9580.html#RFC3629>]). *The resulting 
UTF-8 byte stream is hashed*./

I would happily create an erratum if only I understood what is meant by 
this text if not reencoding. Is it meant to signify a persistent 
*/modification/* of the document to be signed? I can't believe that, as 
that would mean a substantial side effect.

So I think the first step is to get an understanding what the quoted 
text is specifying for the case that a non-UTF-8 document is signed.

Best regards,
Falko

>
>        --dkg
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email protected]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]