[openpgp] canonicalizing document for OpenPGP "Text Signatur e" (sig typeID 0x01) [was: Re: Re: Analysis docume nt]

On Tue 2025-09-16 13:55:12 +0200, Falko Strenzke wrote:
> I would happily create an erratum if only I understood what is meant by 
> this text if not reencoding. Is it meant to signify a persistent 
> */modification/* of the document to be signed? I can't believe that, as 
> that would mean a substantial side effect.

I think it simply means "feed the UTF-8, CRLF form of the document into
the digest algorithm for signing".

As a concrete example, consider the standard tools iconv [0] and todos
[1].  If the message is encoded in ISO-8859-1, feed it into the standard
input of "iconv -f iso-8859-1 -t utf-8 | todos", and use the standard
output of that pipeline in the signing process.

[0] https://manpages.debian.org/stable/manpages/iconv.1.en.html
[1] https://manpages.debian.org/stable/tofrodos/todos.1.en.html

This leaves the original document in all its iso-8859-1, linefeed-only
splendor, while still producing a signature over the canonicalized form.

A verifier can perform the a comparable transformation before verifying,
since they might have received the same document encoded in many
different possible ways, due to "helpful" intervening agents in whatever
chain of copies took it from the signer to the verifier.

The key insight here is that digital documents can appear in many
different forms, and there is no difference between the "original" and a
copy.  At the same time, digital documents are typically not transmitted
so much as they are copied.

Is the "original" transformed during the course of signing? It could be,
if the signer decides to replace it with the canonicalized form!  If it
is, it will be a new file.  If it isn't transformed, that should be OK
too.  Both encodings of the document will have a verifiable signature,
if it is sig typeID 0x01 (Text Signature).

        --dkg

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRjrBGOWy5dZsiKhad4C4VO2cK0lgUCaMmyIgAKCRB4C4VO2cK0
lg2JAP9xZUFq462RCEpLi+yDIUQF9zbzYd86sZiKBZl/R8g63QD9Ggb+ua8asGcj
7VlyDVKANm/qH5niZ7BFRU6FUqNwugk=
=NvxW
-----END PGP SIGNATURE-----