[openpgp] Re: ecosystem split: text-mode signatures over C R-only line endings
Andrew Gallagher <[email protected]> Sun, 26 Oct 2025 11:29:36 +0000
| Newsgroups | gmane.ietf.openpgp |
|---|---|
| Message-ID | <[email protected]> |
Hi, Heiko. I think this is also worth properly documenting. I’ll add a paragraph to draft-signatures to this effect. — Andrew Gallagher > On 26 Oct 2025, at 10:54, Heiko Schäfer <[email protected]> wrote: > > Hey Daniel, > > thanks for your debugging and writeup! > > To my mind, this reads like there's some consensus between implementations that bare CR bytes should *not* be normalized which hashing. > I'll propose a change to rPGP to align with that approach. > > :) Heiko > > >> On 10/15/25 11:28 PM, Daniel Kahn Gillmor wrote: >> Hey OpenPGP folks-- >> >> I've been doing some attempts at aligning various OpenPGP >> implementations, and i think i've stumbled into an ecosystem split. >> >> This shows up in the interoperability test suite, at >> >> https://sequoia-pgp.gitlab.io/openpgp-interoperability-test-suite/results.html#Detached_signatures__Linebreak_normalization >> >> In particular, the line that tests whether the message "one\rtwo\rthree" >> can be validated by a text-mode signature over ""one\r\ntwo\r\nthree" >> >> We can see from this split that the following implementations believe >> that `\r` is a line-ending that needs to be normalized for text-mode >> signatures: >> >> - sequoia >> - rpgp >> - pgpainless-cli >> >> but these other implementations do not: >> >> - GnuPG >> - RNP >> - GOpenPGP >> - OpenPGP.js >> - PGPy >> >> Even weirder, from the latter batch, it looks like GOpenPGP does >> something entirely different from the others with a carriage-return-only >> file. signatures made from gosop don't verify in GnuPG or RNP, in >> addition to the other three that do normalize `\r`: >> >> https://github.com/ProtonMail/gosop/issues/48 >> >> You can test this manually by signing a one-octet message that consists >> only of `\r` , and try verifying the different options. >> >> I'm not sure i understand what's happening with gosop here. >> >> I've also opened a request for a new interop test to try to get more >> data: >> >> https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/issues/168 >> >> All of the tests i've done were on Debian GNU/Linux systems, where the >> "native" line ending is `\n`. >> >> I looked in RFC 9580, and it doesn't specify what "line endings" >> actually means, other than to say that they should be converted to CRLF. >> >> So i think the following question is what we need to answer: >> >> - is `\r` (CR) on its own a "line-ending" that needs to be converted to >> CRLF when signing in text mode? >> >> How can we resolve this? you'd think by 2025 we'd have all the line >> ending issues sorted out. >> >> --dkg >> >> _______________________________________________ >> openpgp mailing list -- [email protected] >> To unsubscribe send an email to [email protected] > > _______________________________________________ > openpgp mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ openpgp mailing list -- [email protected] To unsubscribe send an email to [email protected]