Hi list. On Tue, Jan 27, 2009 at 10:44 PM, Peter Thomas <[email protected]> wrote: > On Tue, Jan 27, 2009 at 4:48 PM, David Shaw <[email protected]> wrote: >> The RFC is really a file format document more so than a "how to use trust" >> document. Every now and then it is suggested that a trust document or >> something like an OpenPGP best practices document should be written, but >> nobody has taken up the suggestion yet. So the RFC that we have (4880) does >> not specify or deny this behavior: it simply lists the signature types for >> reference. So all that said, I don't know if any other products ignore 0x11 >> signatures. > Ok,.. so this means basically that I, as an end user, must expect that > some (stupid) implementation may take my 0x11 and fully trusts it, > right? Was this assumption correct?
> And which one did you mean with the second? Ah. I've probably found this one out myself. The embedded back-signatures are inside the un-hashed area. What was the reason for this? Simply because it's not necessary as the back-signature secures itself? > Ok so I assume the Issuer (16) subpacket is a hint that tells which > public key should be used for verification, and the 16 bits are the 16 > leftmost bits. > So to speed up things, an implementation uses the public key from the > Issuer subpacket for calculations, makes a first check after the 16 > bits of the signature hash, and only if these are equal, checks the > remaining ones. > Is this correct? Same as above,... were these assumptions correct? Thanks, Peter _______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
