Subject: cleartext signatures - trailing white space - proposal (2)

From: Ian Grigg <[email-masked]>
Date: Fri, 12 Mar 2004 14:10:47 -0500

Combining comments from today, this is an updated proposal.  7.1
should be unchanged.
=================================================================

7.1. Dash-Escaped Text

     The cleartext content of the message must also be dash-escaped.

     Dash escaped cleartext is the ordinary cleartext where every line
     starting with a dash '-' (0x2D) is prefixed by the sequence dash '-'
     (0x2D) and space ' ' (0x20). This prevents the parser from
     recognizing armor headers of the cleartext itself. An implementation
     MAY dash escape any line, SHOULD dash escape lines commencing
     "From " (note the space), and MUST dash escape any line commencing
     in a dash. The message digest is computed using the cleartext
     itself, not the dash escaped form.

     When reversing dash-escaping, an implementation MUST strip the
     string "- " if it occurs at the beginning of a line, and SHOULD warn
     on "-" and any character other than a space at the beginning of a
     line.

7.2. Canonical Line Endings

     As with binary signatures on text documents, a cleartext signature
     is calculated on the text using canonical <CR><LF> line endings.
     The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
     SIGNATURE-----' line that terminates the signed text is not
     considered part of the signed text.  See 6.2.

     When calculating a cleartext signature, trailing whitespace
     at the end of the line shall be removed (and replaced by the
     sequence <CR><LF> as above).  This protects against a failure
     of a valid signature due to conversions that may occur in text
     editing or in transport.

     Whitespace for cleartext signature end-trimming is defined to
     be the characters <SPACE> (0x20), <TAB> (0x09), <CR> (0x0D)
     and <LF> (0x0A).  No Unicode whitespace is defined.

     End-trimming whitespace may open a cleartext signed message to an
     attack of overstriking of key parts of text.  Display of cleartext
     signed messages should take care to strip whitespace before display
     (both before and after signing and verification).

8. ...
=================================================================

---

From: Werner Koch <[email-masked]>
Date: Sun, 14 Mar 2004 19:37:00 +0100

> Combining comments from today, this is an updated proposal.  7.1

Fine with me.

  Werner