Subject: Signature targets and where they should be used

From: David Shaw <[email-masked]>
Date: Mon, 14 Apr 2003 20:13:58 -0400

In section 5.2.1 of bis-07, in the paragraph about notary signatures,
the draft reads:

  Note that a notary signature SHOULD include a Signature Target
  subpacket to give easy identification.

I disagree this is necessary.  As I see it, the point of a signature
target subpacket is to identify a signature *when that identification
is not obvious from the new signature*.

A signature target can be necessary or useful when issuing a
certification revocation signature (i.e. 0x30).  This case is
signature A (the 0x30 signature), on data B (primary key + user ID),
referring to signature C (the original 0x10-0x13 signature).  In this
case, a signature target is required to specify which signature C is.

In the case of notary signatures, there is no "C" to specify.  It is
merely signature A (the 0x50 signature), on data B (the signature to
be notarized).  There is no benefit in specifying B twice as the data
to be signed and then again as an additional subpacket.

In the interest of simplicity, I would like to strike the sentence
above.  Note that this does not prevent someone from using a signature
target for notary signatures if they still choose to.  All I am
advocating is removing any requirement (even a SHOULD) that they do
so.

David

---

From: "Michael Young" <[email-masked]>
Date: Wed, 16 Apr 2003 15:40:24 -0400

From: "David Shaw" <[email-masked]>
> I disagree this is necessary.  As I see it, the point of a signature

The SHOULD language suggests best practice, not strict requirement.
For notary signatures, that's still quite a stretch, though.

On the other hand, I'd love to see a SHOULD clause for revocations.
The Target subpacket eliminates an ambiguity -- without it, the
revocation could refer to any original signature for the same
key/uid.  (There is no such ambiguity for notary packets, as
the whole original signature is hashed.)  I think that unambiguous
identification is surely a best practice.

So, could you simply move the SHOULD clause from the notary
signature section to revocations :-?

> to be signed and then again as an additional subpacket.

I'd agree that the benefit is slight at best.  I suppose if
you had "B" and the material it covered (so that you could generate
B's hash), and you had a disorganized bunch of notary signatures,
then you could pick out the matching ones faster if they had
target subpackets.  This doesn't seem like a compelling scenario. :-)

---

From: David Shaw <[email-masked]>
Date: Wed, 16 Apr 2003 17:38:37 -0400

> target subpackets.  This doesn't seem like a compelling scenario. :-)

There is actually another reason why using targets for notary
signatures is not really good: one of the nice features of notary
signatures is that the notarizer doesn't need the original signer's
public key or the material the original signature covered.  All the
notarizer needs is the signature packet.  Unfortunately, to use a
signature target in the notary signature, the notarizer needs the
original signer's public key to extract the hash from the original
signature packet...

I suppose we could solve that problem by defining a signature target
to be the canonical hash of the signature being targeted, but even
then there is still no good reason why using a target for notary
signatures needs to be a SHOULD.

David

---

From: David Shaw <[email-masked]>
Date: Wed, 16 Apr 2003 17:38:37 -0400

David