OpenPGP Signatures and Signed Messages

3.1. Certification Signature Types (0x10..0x13)

Section 5.2.1 of [RFC9580] defines four types of certification signature (0x10..0x13). All may be created by either the key owner or a third party, and may be calculated over either a User ID packet or a User Attribute packet. In addition, a Certification Revocation signature revokes signatures of all four types.¶

Historically, certifications were only made by third parties. First-party self-certifications only became customary later, and were made mandatory when preference subpackets were introduced.¶

The semantic distinctions between the certification signature types were left ill-defined and most software treats them as equivalent. The following convention has evolved over time [ASKCERTLEVEL], and is hereby specified:¶

• 0x10 Generic Certification SHOULD only be used for third-party certifications.¶

• 0x11 Persona Certification is deprecated and SHOULD NOT be created.¶

• 0x12 Casual Certification is deprecated and SHOULD NOT be created.¶

• 0x13 Positive Certification SHOULD only be used for self-certifications.¶

A receiving implementation MUST treat a third-party certification of any of the above types as equivalent to a type 0x10 signature, and a first-party certification of any of the above types as equivalent to a type 0x13 signature.¶

3.2. Primary Key Revocation Signature (Type 0x20)

Section 5.2.1.11 of [RFC9580] defines the Key Revocation Signature as:¶

• This signature is calculated directly on the key being revoked. A revoked key is not to be used. Only Revocation Signatures by the key being revoked, or by a (deprecated) Revocation Key, should be considered valid Revocation Signatures.¶

The name and description are potentially confusing, as it can only revoke a Primary Key and not a Subkey -- other OpenPGP artifacts that are named "Key" without a qualifier (such as the "Key Flags" and "Key Expiration Time" subpackets) apply to both Primary Keys and Subkeys.¶

We therefore rename the 0x20 signature type to "Primary Key Revocation Signature" for clarity, and update its definition as follows:¶

• This signature is calculated directly on the primary key being revoked. A revoked primary key is not to be used. Only Revocation Signatures by the primary key being revoked, or by a (deprecated) Revocation Key, should be considered valid Primary Key Revocation Signatures.¶

3.3. Subkey Revocation Signature (Type 0x28)

Section 5.2.1.11 of [RFC9580] defines the Subkey Revocation Signature as:¶

• This signature is calculated directly on the primary key and the subkey being revoked. A revoked subkey is not to be used. Only Revocation Signatures by the top-level signature key that is bound to this subkey, or by a (deprecated) Revocation Key, should be considered valid Revocation Signatures.¶

The phrasing "top-level signature key that is bound to this subkey" is confusing. Instead, we update the definition for clarity:¶

• This signature is calculated directly on the primary key and the subkey being revoked. A revoked subkey is not to be used. Only Revocation Signatures by the primary key, or by a (deprecated) Revocation Key, should be considered valid Subkey Revocation Signatures.¶

3.4. Certification Revocation Signature (Type 0x30)

Section 5.2.1.13 of [RFC9580] defines the Certification Revocation Signature as:¶

• This signature revokes an earlier User ID certification signature (Type IDs 0x10 through 0x13) or Direct Key signature (Type ID 0x1F). It should be issued by the same key that issued the revoked signature or by a (deprecated) Revocation Key. The signature is computed over the same data as the certification that it revokes, and it should have a later creation date than that certification.¶

Section 5.2.4 of [RFC9580] is clear that Direct Key signatures and Certification Signatures have completely different constructions. This implies that there are two different ways to construct a Type 0x30 signature, each of which appears in a different part of an OpenPGP certificate.¶

The above definition dates back to [RFC2440], except for the "or Direct Key Signature" clause which was added to the first sentence in [RFC4880]. But the third sentence still defines the construction unconditionally by reference to "the certification that it revokes", even though it does not necessarily revoke a certification.¶

The use of a Certification Revocation Signature to revoke a Direct Key Signature is imprecise and not widely supported, and is hereby deprecated.¶

(See also Section 6.1)¶

3.5. Timestamp Signature (0x40)

Section 6.2.1 of [RFC1991] defined the Timestamp signature as:¶

• <40> - time stamping ("I saw this document")¶

  Type <40> is intended to be a signature of a signature, as a notary seal on a signed document.¶

The second statement implies that a v3 0x40 sig is made over a signature packet. But the first statement implies a signature over a document, just with different semantics.¶

By Section 5.2.1.14 of [RFC9580], this has changed to:¶

• 0x40: Timestamp signature. This signature is only meaningful for the timestamp contained in it.¶

This avoids the apparent contradiction of [RFC1991], but is less informative. And there is no explicit construction given in Section 5.2.4 of [RFC9580].¶

Note also that [RFC4880] introduced a Key Flag for timestamping. This would appear to indicate that timestamping documents is sufficiently different from signing them that separate keys should be used. This is consistent with the idea that "I wrote this document" and "I saw this document" are distinct statements with different consequences. This is crucial in the case of an automated timestamping service that makes no claims about the accuracy of document contents.¶

An OPS packet contains a "nesting" octet that controls whether an inner OPS signature is included in the data signed over by the outer OPS signature (see Section 4). By reference to [FINNEY1998], we can reconcile the above variations in semantics.¶

We define type 0x40 Timestamp signatures as follows:¶

• A type 0x40 Timestamp signature is made over an OpenPGP Message, and constructed the same way as a type 0x00 Binary Document Signature. If the message is a text document, it SHOULD already be in Canonical Text form. By default a Timestamp signature conveys no opinion about the validity of the document; it only claims that the document existed at the timestamp of signature creation. This interpretation MAY be modified by adding notation subpackets, the meaning of which are application-dependent. It can be made over an otherwise unsigned document, or it can be one of many signatures over the same document.¶

Countersigning a Signature packet only (including blind countersigning) is done using the type 0x50 Third Party Confirmation signature.¶

3.6. Third Party Confirmation Signature (0x50)

Section 5.2.1.15 of [RFC9580] defines a Third-Party Confirmation signature as:¶

• This signature is a signature over some other OpenPGP Signature packet(s). It is analogous to a notary seal on the signed data. A Third-Party Confirmation signature SHOULD include a Signature Target subpacket that identifies the confirmed signature.¶

A concrete construction is provided, but the placement and semantics are still not well-defined. We clarify these as follows:¶

• By default, a Third Party Confirmation signature makes no claim about the validity of the other signature, just its existence, and makes no claim whatsoever about the subject of that signature. This interpretation MAY be modified by adding notation subpackets, the meaning of which are application-dependent. It MAY be included in an Embedded Signature packet in the unhashed area of the signature it notarises; if it is so located, a Signature Target SHOULD NOT be included. Otherwise, it SHOULD be distributed as a detached signature.¶

4.1. OPS Subject Types

The subject of an OpenPGP signature is the section of the data stream that is passed to the signature's digest function, aside from any metadata or fixed data. This data may undergo normalisation, depending on the signature context.¶

[FINNEY1998] suggests that a three-state nesting flag is required for an unambiguous treatment of all possible OPS subjects.¶

We constrain OPS structures to a subset of configurations, and fully specify the handling of OPS signature subjects. The OPS nesting octet is renamed to "OPS Subject Type" to better convey its semantics, and the following values are specified:¶

• A prefixed Signature packet signs over the next literal or compressed packet, ignoring any intervening signature or OPS packets.¶

• When one or more prefixed signature packets and one or more one-pass signatures sign over the same subject, the prefixed Signature packet(s) MUST precede the OPS packet(s); this is only permitted if the OPS uses the Literal Body Subject Type.¶

4.2. Formal Grammar

The message grammar in Section 10.3 of [RFC9580] is therefore updated to:¶

• OpenPGP Message:
  Encrypted Message | Unencrypted Message.¶

• Unencrypted Message:
  Signed Message | Unsigned Message.¶

• Unsigned Message:
  Compressed Message | Literal Message.¶

• Compressed Message:
  Compressed Data Packet.¶

• Literal Message:
  Literal Data Packet.¶

• ESK:
  Public Key Encrypted Session Key Packet | Symmetric Key Encrypted Session Key Packet.¶

• ESK Sequence:
  ESK | ESK Sequence, ESK.¶

• Encrypted Data:
  Symmetrically Encrypted Data Packet | Symmetrically Encrypted and Integrity Protected Data Packet.¶

• Encrypted Message:
  Encrypted Data | ESK Sequence, Encrypted Data.¶

• Nested One-Pass Signed Message:
  Nested One-Pass Signature Packet, One-Pass Signed Message, Corresponding Signature Packet.¶

• Literal Body One-Pass Signed Message:
  Literal Body One-Pass Signature Packet, Unsigned Message, Corresponding Signature Packet.¶

• Verbatim One-Pass Signed Message:
  Verbatim One-Pass Signature Packet, Unencrypted Message, Corresponding Signature Packet.¶

• One-Pass Signed Message:
  Nested One-Pass Signed Message | Literal Body One-Pass Signed Message | Verbatim One-Pass Signed Message.¶

• Signed Message:
  Signature Packet, Unencrypted Message | One-Pass Signed Message.¶

• Optionally Padded Unencrypted Message:
  Unencrypted Message | Unencrypted Message, Padding Packet.¶

In addition to these rules, a Marker packet (Section 5.8 of [RFC9580]) can appear anywhere in the sequence.¶

4.3. Unwrapping Encrypted and Compressed Messages

[RFC9580] permits an encrypted message to contain another encrypted message, and a compressed message to contain another compressed message, possibly recursively. Such messages require potentially unbounded resources for negligible added utility, and therefore MUST NOT be created.¶

In addition, encrypt-then-sign messages are not idiomatic OpenPGP, and SHOULD NOT be generated.¶

The guidance in Section 10.3.1 of [RFC9580] is therefore updated to:¶

• Decrypting a version 2 Symmetrically Encrypted and Integrity Protected Data packet MUST yield a valid Optionally Padded Unencrypted Message.¶

• Decrypting a version 1 Symmetrically Encrypted and Integrity Protected Data packet or -- for historic data -- a Symmetrically Encrypted Data packet MUST yield a valid Unencrypted Message.¶

• Decompressing a Compressed Data packet MUST yield a valid Literal Message.¶

((TODO: is this too constraining on compressed data packet contents?))¶

4.4. Marker Packet

Section 5.8 of [RFC9580] defines the Marker Packet as follows:¶

• The body of the Marker packet consists of:¶

  • The three octets 0x50, 0x47, 0x50 (which spell "PGP" in UTF-8).¶

  Such a packet MUST be ignored when received.¶

We update this to include:¶

• If a receiving implementation encounters a Marker Packet with any other contents, the entire packet sequence SHOULD be ignored.¶

• A Marker Packet MAY be added by an application to notify non-OpenPGP software that a data stream contains OpenPGP data. If so, the Marker Packet SHOULD be the first packet in the sequence, and SHOULD NOT use a Legacy header, so that it can be easily detected.¶

6.1. Key Flags

A Key Flags subpacket SHOULD be included in a Direct Key or Subkey Binding signature (or for v4 keys, a self-certification over the primary User ID). It applies only to a single key material packet; for a Direct Key signature (or primary User ID self-cert) it applies to the primary key only, and for a Subkey Binding signature, it applies only to that subkey.¶

Previously, it was also specified for use in third-party Certification Signatures. This is not widely supported and is hereby deprecated.¶

The following Key Flags permit the creation of signatures in one or more Signature Categories:¶

• 0x01.. Third-party signatures in the Certification and Certification Revocation Categories¶

• 0x02.. Document Signature Category¶

• 0x0008.. Timestamping Category¶

• ((TBC)) Primary Key Revocation Category¶

• ((TBC)) Countersignature Category¶

The following exceptional usages are always permitted regardless of Key Flags:¶

• Primary keys are always permitted to make self-signatures in the Certification, Key Binding, Certification Revocation, Key Revocation and Subkey Revocation Categories.¶

• Subkeys with signing-capable algorithms are always permitted to make Primary Key Binding signatures.¶

• Any key is permitted to make a signature in the Private and Experimental range.¶

Otherwise:¶

• A signature made by a key that does not have the corresponding Key Flag MUST be considered invalid.¶

• A key with no Key Flags subpacket MUST NOT create signatures.¶

Section 5.2.1.10 of [RFC9580] also explicitly allows keys with the 0x01 Key Flag to create third-party 0x1F Direct Key Signatures. This is not widely supported and is hereby deprecated.¶

6.2. Authentication Signatures

OpenPGP defines no authentication signature types, but does have an authentication Key Flag. Traditionally, authentication is performed by converting the key material into that of another protocol (usually OpenSSH) and performing authentication in that protocol.¶

It should be noted that cross-protocol usage can be exploited to evade the domain separation protections of Key Flags. For example, there is no distinction between signature, certification and authentication usage in OpenSSH, and once converted an OpenPGP authentication key may be used as a OpenSSH CA or to sign git commits.¶

((TODO: Guidance for the use of authentication keys should be provided.))¶

7.1. General subpackets.

These may be attached to any signature type, and define properties of the signature itself. Some of these subpackets are self-verifying (SV), i.e. they contain hints to locate the issuing key that can be confirmed after the fact. It MAY be reasonable to place self-verifying general subpackets in the unhashed area. All other general subpackets MUST be placed in the hashed area.¶

Subpacket types: Signature Creation Time, Signature Expiration Time, Issuer Key ID (SV), Notation Data, Signer's User ID, Issuer Fingerprint (SV).¶

(Notation subpackets are categorised here as general subpackets, however the notations within them may have arbitrary semantics at the application layer)¶

7.2. Context subpackets.

These have semantics that are meaningful only when used in signatures of a particular type or category:¶

7.3. Data type subpackets.

These are only meaningful in signature types whose specification explicitly requires them. They SHOULD NOT be used elsewhere. They have no intrinsic semantics; all semantics are defined by the enclosing signature.¶

Subpacket types: Signature Target, Embedded Signature, (Delegated Revoker), (Approved Certifications).¶

7.4. Subpackets summary

Three subpacket types are Boolean, with different default values for when they are absent (two true, one false). It is RECOMMENDED that these subpackets not be used to convey their default values, only the non-default value. The default value SHOULD instead be conveyed by the absence of the subpacket.¶

Unless otherwise indicated, subpackets SHOULD NOT be marked critical. In particular, a critical subpacket that invalidates a self-signature will leave the previous self-signature (or no self-signature!) as the most recent valid self-signature from the PoV of some receiving implementations. A generating implementation MUST be sure that all receiving implementations will behave as intended if a signature containing a critical subpacket is invalidated. Otherwise, with the possible exception of document signatures, it is NOT RECOMMENDED to set the critical bit.¶

It is RECOMMENDED that a signature's creator places all subpackets in the hashed area, even self-verifying subpackets for which this is not strictly necessary. The unhashed area MAY be used for informational subpackets attached by third parties (which can be safely stripped).¶

7.5. Guidance for management of the Signature Subpacket Registry

• Future boolean subpackets SHOULD NOT contain an explicit value; a value of TRUE SHOULD be indicated by the presence of the subpacket, and FALSE otherwise.¶

• Specification of new subpackets SHOULD address classification, criticality and self-verification as outlined above.¶

• Subpackets SHOULD be implemented in the private/experimental area first, then reassigned to a permanent code point.¶

7.6. Unhashed Subpacket Deduplication

Unhashed subpacket areas are malleable and so may have subpackets added or removed in transit, either innocently or maliciously. A receiving implementation SHOULD clean the unhashed area of subpackets that are not meaningful or trustworthy outside the hashed area. If two signature packets are bitwise identical apart from differences in their unhashed subpacket areas, an implementation MAY merge them into a single signature. If two unhashed subpackets in the merged signature are bitwise identical, they MUST be deduplicated. Otherwise, the unhashed subpacket area of the merged signature SHOULD contain the useful subpackets from both original signatures, even if this means multiple subpackets of the same type.¶

8.1. Key and Certification Validity Periods

Key Expiration Time subpackets are a rich source of footguns:¶

1. They specify an offset rather than an timestamp, but are not usable without first converting to a timetamp.¶

2. The offset is calculated relative to the creation timestamp of a different packet (the (sub)key packet).¶

3. Some implementations interpret them as being inheritable in their raw form, so that the same offset value gets applied to different creation timestamps.¶

Further, their semantics overlaps that of Signature Expiration Time:¶

1. If the binding signature over a key expires, but the key does not, the key is nevertheless unusable due to lack of signatures.¶

2. If a key expires, but the signature over it does not, the signature is unusable.¶

This means there are effectively two expiration dates on a Key Binding signature, the key expiration and the signature expiration, but without distinct semantics.¶

In addition, the Signature Creation Time subpacket has an overloaded meaning in both Key Binding and Certification signatures:¶

1. It is used as the "valid from" timestamp of the object being signed over¶

2. It is used to order multiple similar signatures to determine which is valid¶

If this is interpreted strictly, it means that it is not possible to create a new Key Binding signature that reliably leaves the starting date of the key's validity unchanged. Some implementations have worked around this by generating signatures with creation dates backdated to one second after that of the previous signature.¶

The ability to create a new signature with an unchanged valid-from date allows historical signatures to be losslessly cleaned from a TPK, saving space. It is also more compatible with the historical interpretation favoured by PGP and GnuPG.¶

8.2. Key Binding Temporal Validity

To clean up the ambiguity in Key Binding signatures, we specify the following:¶

1. Key Binding signatures (Subkey Binding signatures, Primary Key Binding signatures, Direct Key signatures, BUT NOT self-certifications over v4 Primary User IDs) SHOULD NOT contain Signature Expiration Time subpackets.¶

2. The validity of a (sub)key extends from its creation time until its revocation or key expiration time.¶

3. If the most recent Key Binding signature has no Key Expiration Time subpacket, then the key does not expire.¶

4. A signature is valid if it was made by a (sub)key during its validity period.¶

5. The creation time of the Key Binding signature is used only for ordering, not for calculation of signature validity.¶

6. Key Expiration Time subpackets are only meaningful in Key Binding signatures; an implementation MUST ignore a Key Expiration Time subpacket in any other signature.¶

We also specify that Key Binding signatures cannot be directly revoked; the corresponding revocation signatures affect the key, not the binding.¶

(See also [RFC4880BIS-71], [OPENPGPJS-1800], and [REVOC-19]).¶

8.3. Certification Temporal Validity

It is not customary for Certification signatures, even self-certifications over v4 Primary User IDs, to contain Key Expiration Time subpackets. Instead, the Signature Expiration Time subpacket is used. In addition, User IDs and User Attributes do not contain a creation time field. Together, this means that we cannot solve the temporal validity issue for Certifications as easily as we did for Key Bindings.¶

Instead, we specify the following:¶

((TODO: who knows at this point, all the options have problems))¶

• Option 1: new signature subpacket type that contains a Valid From time¶

  • PRO: easy to implement¶

  • CON: will need to exist in parallel with existing calculations¶

• Option 2: new Packet type that contains a User ID and a Valid From time¶

  • PRO: also lets us use URIs instead of RFC822-ish¶

  • CON: backwards compatibility¶

• Option 3: new User Attribute subpacket type that contains a User ID and a Valid From time¶

  • PRO: as option 2¶

  • CON: as option 2, also UAT packets contain arbitrary content, cannot certify only one subpacket¶

8.4. Cumulation of Signatures

A cryptographically valid Key Binding, certification or document signature automatically and permanently supersedes any earlier signature of the same Signature Category, by the same key pair, over the same subject. If a later such signature expires before an earlier one, the earlier signature does not become valid again.¶

For the purposes of the above:¶

• "same key pair" refers to the public key packet as identified by the Issuer KeyID or Issuer Fingerprint subpacket.¶

• "same subject" refers only to the data fed into the signature digest function after the end of the salt (if appropriate) and before the beginning of the trailer.¶

(See also [SCHAUB2021])¶

10.1. OpenPGP Signature Types Registry

IANA is requested to add a column to the OpenPGP Signature Types registry, called "Embeddable". This column should be empty by default.¶

IANA is requested to register the following new entry in the registry:¶

IANA is requested to update the following existing entries in the registry:¶

10.2. OpenPGP Key Flags Registry

IANA is requested to register the following new entries in the OpenPGP Key Flags registry:¶

IANA is requested to update the following existing entries in the registry:¶

10.3. OpenPGP Signature Subpacket Types Registry

IANA is requested to add columns for "Category", "Critical", and "Self-Verifying" to the OpenPGP Signature Subpacket Types registry, and populate them with initial values as listed in Table 2.¶