Series of minor questions about OpenPGP 3

[Peter Thomas]

Hi list.

On Tue, Jan 27, 2009 at 10:44 PM, Peter Thomas <p4.thomas at googlemail.com> wrote:
> On Tue, Jan 27, 2009 at 4:48 PM, David Shaw <dshaw at jabberwocky.com> wrote:
>> The RFC is really a file format document more so than a "how to use trust"
>> document.  Every now and then it is suggested that a trust document or
>> something like an OpenPGP best practices document should be written, but
>> nobody has taken up the suggestion yet.  So the RFC that we have (4880) does
>> not specify or deny this behavior: it simply lists the signature types for
>> reference.  So all that said, I don't know if any other products ignore 0x11
>> signatures.
> Ok,.. so this means basically that I, as an end user, must expect that
> some (stupid) implementation may take my 0x11 and fully trusts it,
> right?
Was this assumption correct?


> And which one did you mean with the second?
Ah. I've probably found this one out myself.
The embedded back-signatures are inside the un-hashed area.
What was the reason for this? Simply because it's not necessary as the
back-signature secures itself?


> Ok so I assume the Issuer (16) subpacket is a hint that tells which
> public key should be used for verification, and the 16 bits are the 16
> leftmost bits.
> So to speed up things, an implementation uses the public key from the
> Issuer subpacket for calculations, makes a first check after the 16
> bits of the signature hash, and only if these are equal, checks the
> remaining ones.
> Is this correct?
Same as above,... were these assumptions correct?


Thanks,
Peter