On Mon, Dec 26, 2005 at 05:29:01PM +0000, Ian G wrote:
David Shaw wrote:
As far as I can see, the current system is quite reversible. For
example, given a document reading "this is a test" (no line ending,
and the last character in the file is the second t from test), here's
a clear signature:
OK, I understand all that. But you've added
a new rule: on signing, always add the extra
line ending.
And that's what we want to clarify - I don't
think the spec says that. It simply says that
the last newline is not part of the signature.
Ok, now we're cooking: we agree. I don't think the spec says that
either. I am just saying that that behavior is consistent with the
spec, and (I say) a good thing to do, and (to me) follows naturally
from what the spec does say. That said, GPG doesn't do it, and PGP
(at least the version I have here) does.
Both PGP and GPG are compliant with the spec as written. If you add
this extra rule to enforce reversibility, GPG will become noncompliant
(fixable, but annoying), and many GPG-created signatures will become
noncompliant (a little more worrisome).
Can we put that in the spec? Here's what it
says:
As with binary signatures on text documents, a cleartext signature
is calculated on the text using canonical <CR><LF> line endings.
The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
SIGNATURE-----' line that terminates the signed text is not
considered part of the signed text.
When reversing dash-escaping, an implementation MUST strip the
string "- " if it occurs at the beginning of a line, and SHOULD warn
on "-" and any character other than a space at the beginning of a
line.
Also, any trailing whitespace -- spaces (0x20) and tabs (0x09) -- at
the end of any line is removed when the cleartext signature is
generated.
Here's what I suggest (changes at ***):
As with binary signatures on text documents, a cleartext signature
is calculated on the text using canonical <CR><LF> line endings.
The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
SIGNATURE-----' line that terminates the signed text is not
*** part of the signed document and SHOULD be added by implementations. ***
When reversing dash-escaping, an implementation MUST strip the
string "- " if it occurs at the beginning of a line, and SHOULD warn
on "-" and any character other than a space at the beginning of a
line.
Also, any trailing whitespace -- spaces (0x20) and tabs (0x09) -- at
the end of any line is removed when the cleartext signature is
generated.
How's that?
I have no objection to that.
David