RFC2440

7. Cleartext signature framework

It is desirable to sign a textual octet stream without ASCII armoring the stream itself, so the signed text is still readable without special software. In order to bind a signature to such a cleartext, this framework is used. (Note that RFC 2015 defines another way to clear sign messages for environments that support MIME.)

The cleartext signed message consists of:

The cleartext header '-----BEGIN PGP SIGNED MESSAGE-----' on a single line,
One or more "Hash" Armor Headers,
[GnuPg: An optional "NotDashEscaped" Armor Header.]
Exactly one empty line not included into the message digest,
The dash-escaped cleartext that is included into the message digest,
The ASCII armored signature(s) including the '-----BEGIN PGP SIGNATURE-----' Armor Header and Armor Tail Lines.

If the "Hash" armor header is given, the specified message digest algorithm is used for the signature. If there are no such headers, MD5 is used, an implementation MAY omit them for V2.x compatibility. If more than one message digest is used in the signature, the "Hash" armor header contains a comma-delimited list of used message digests.

Current message digest names are described below with the algorithm IDs.

7.1. Dash-Escaped Text

The cleartext content of the message must also be dash-escaped. [GnuPG: If the "NotDashEscaped" Armor Header is used dash-escaped text is NOT used. The content of the message is not changed with the exception that the last line must always end with a LF (GnuPG inserts a missing LF). This special encoding is used to allow clear signed patch files]

Dash escaped cleartext is the ordinary cleartext where every line starting with a dash '-' (0x2D) is prefixed by the sequence dash '-' (0x2D) and space ' ' (0x20). This prevents the parser from recognizing armor headers of the cleartext itself. The message digest is computed using the cleartext itself, not the dash escaped form.

As with binary signatures on text documents, a cleartext signature is calculated on the text using canonical <CR><LF> line endings. The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP SIGNATURE-----' line that terminates the signed text is not considered part of the signed text.

Also, any trailing whitespace (spaces, and tabs, 0x09) at the end of any line is ignored when the cleartext signature is calculated.

[GnuPG: Has an option to dash escape "From " lines; this is what PGP does and makes sense, because some MUA change these lines to ">From "]

HTML conversion and comments on this are RFC are Copyright (c) 1998 Werner Koch, Remscheider Str. 22, 40215 Düsseldorf, Germany. Verbatim copying and distribution is permitted in any medium, provided this notice is preserved. See here for copyright information on the RFC itself.

Updated: 1999-09-30 wkoch