ietf-openpgp
[Top] [All Lists]

Re: Outstanding question - rule on cleartext signing last line

2005-12-28 02:26:12

In my opinion, the spec is clear enough about how to verify clearsigned
messages and that is all that must be specified. I agree with Jon that it is
ultimately up to the applications how they pre-process the text to be
signed, as long as the human-readable part does not change (you sign what
you see).

I don't want to standardize either behavior: in my implementation
(ePointPGP) cleartext signatures are reversible and it is actually
important. I don't want the standard to declare me wrong. I don't want the
standard to declare widely used implementations such as GPG wrong either. I
regard it primarily as a back-end, and if someone wants to make reversible
clearsigned documents and be sure about it, it's still possible with
detached text signatures and perhaps some trivial pre-processing. The end
result can be put together as a clearsigned document. The behavior won't
change if Werner decides to tweak clearsigning a bit further in a future
version of GPG.

-- 
Daniel