Subject: Re: critical bit (5.2.3.1)

From: Hal Finney <[email-masked]>
Date: Wed, 30 Sep 1998 07:48:06 -0700

Werner Koch, <[email-masked]>, writes:
> >From section 5.2.3.1:
>
> > Bit 7 of the subpacket type is the "critical" bit.  If set, it
> > denotes that the subpacket is one that is critical for the evaluator
> > of the signature to recognize.  If a subpacket is encountered that
> > is marked critical but is unknown to the evaluating software, the
> > evaluator SHOULD consider the signature to be in error.
>
> Can we restrict the SHOULD to hashed subpackets?  Otherwise it is
> easy to invalidate a signature by setting the critical bit in a
> unhashed subpacket.

I'm not sure what issue you are concerned with;

If I create a signature and set the critical bit on an unhashed packet,
it means that I want you to understand that packet before you accept
the signature.  So in this case it is my desire that the signature should
be invalidated if you don't understand the packet.

If an attacker tries to make a signature invalid by adding an unhashed
packet with the critical bit set, he could have just as easily modified
some part of the hashed region, or the signature itself.

Hal

---

From: Werner Koch <[email-masked]>
Date: Wed, 30 Sep 1998 17:52:27 +0200

> some part of the hashed region, or the signature itself.

I thought about it while working on the import stuff; but you are
right it doesn't matter whether the critical bit is in the hashed or
unhashed region.  

Thanks,

  Werner

---

From: "Tim Dierks" <[email-masked]>
Date: Wed, 30 Sep 1998 09:42:50 -0700

> some part of the hashed region, or the signature itself.

I agree with this; however, the converse is a problem. If you make an
unhashed packet critical, an attacker can turn the critical bit off without
invalidating the security; this means that critical bits cannot be relied
upon, and as such should not be part of the signature validation procedure.
I would suggest that critical bits only be supported in hashed subpackets.

 - Tim