mirror of
https://codeberg.org/openpgp/notes.git
synced 2024-11-30 11:32:07 +01:00
Merge pull request 'Chapter 6-8 [Paul +Heiko edits]' (#88) from sigs-h into draft
These chapters are still in draft quality (and will be copy edited and reviewed later)
This commit is contained in:
heiko
commit
256276af2e
13 changed files with 1675 additions and 120 deletions
|
|
@ -6,3 +6,7 @@ Source: https://codeberg.org/openpgp/notes
|
||||||
Files: book/source/diag/*.png book/source/diag/*.svg
|
Files: book/source/diag/*.png book/source/diag/*.svg
|
||||||
Copyright: 2023 The "Notes on OpenPGP" project
|
Copyright: 2023 The "Notes on OpenPGP" project
|
||||||
License: CC-BY-SA-4.0
|
License: CC-BY-SA-4.0
|
||||||
|
|
||||||
|
Files: book/source/mermaid/*.md book/source/mermaid/*.png
|
||||||
|
Copyright: 2023 The "Notes on OpenPGP" project
|
||||||
|
License: CC-BY-SA-4.0
|
||||||
|
|
|
||||||
|
|
@ -1,95 +0,0 @@
|
||||||
<!--
|
|
||||||
SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|
||||||
SPDX-License-Identifier: CC-BY-SA-4.0
|
|
||||||
-->
|
|
||||||
|
|
||||||
(certifications_chapter)=
|
|
||||||
|
|
||||||
# Certification signatures
|
|
||||||
|
|
||||||
Signatures make up the magic of OpenPGP.
|
|
||||||
They act as the syntax that allows forming and interpreting complex statements about data and identities.
|
|
||||||
Without signatures there would only be loose keys, impossible to associate with their owner.
|
|
||||||
Signatures are the glue that allows for keys, subkeys and identities to be assembled into hierarchical certificates and for messages to gain authenticity.
|
|
||||||
|
|
||||||
```{admonition} TODO
|
|
||||||
:class: warning
|
|
||||||
|
|
||||||
- Purpose of a signature
|
|
||||||
- Meaning of different signature types, nuances of subpackets
|
|
||||||
- Can we have a "catalogue" of statements a user might want to make, mapping these to archetypical signatures?
|
|
||||||
- Revocation; Hard vs. Soft
|
|
||||||
```
|
|
||||||
|
|
||||||
## Terminology
|
|
||||||
|
|
||||||
The term *signature* can have multiple meanings in the context of the OpenPGP specification.
|
|
||||||
Cryptographic keys create raw signatures which are byte sequences calculated according to some signature scheme.
|
|
||||||
OpenPGP packs these raw signatures up into OpenPGP signature packets, which carry additional information in the form of signature subpackets.
|
|
||||||
For the purpose of this document, the term signature will refer to an OpenPGP signature packet (tag 2).
|
|
||||||
|
|
||||||
OpenPGP signatures can be separated into *data signatures* and *certifications*.
|
|
||||||
A data signature serves the purpose to cryptographically guarantee the authenticity (and implicitly also the integrity) of a message, e.g. an email or a file, while a certification is used to attach metadata or subkeys to a certificate.
|
|
||||||
Data signatures are always calculated by keys carrying the **S**igning key flag, while certifications require keys carrying the **C**ertify Others key flag (with the exception of so called Primary Key Binding Signatures).
|
|
||||||
Different types of signatures are distinguished by a signature type code and are calculated in different ways.
|
|
||||||
Signatures can either be distributed standalone as *detached* signatures, or can be inlined with OpenPGP data, such as an OpenPGP message or a key or certificate.
|
|
||||||
|
|
||||||
Data signatures (type 0x00 and 0x01) are created by hashing the message content and calculating a cryptographic signature over the hash.
|
|
||||||
The result is packed up into an OpenPGP signature packet, which can either be included in the OpenPGP message (TODO: See section about forming messages, cleartext signature framework), or distributed separately as a so called *detached* signature.
|
|
||||||
Data signatures are always calculated using a **S**igning key.
|
|
||||||
|
|
||||||
A certification made by a key over components of the same certificate is referred to as a *self-certification*.
|
|
||||||
A typical use-case for a self-certification is to attach a user ID, such as a name and email address to a certificate.
|
|
||||||
This is done by calculating the signature over the user ID and the public primary key.
|
|
||||||
The resulting user ID certification (typically type 0x13, potentially type 0x10-0x12) can then be inserted into the certificate, right after the user ID packet.
|
|
||||||
|
|
||||||
Other examples for self-signatures are binding signatures for subkeys.
|
|
||||||
In order to add an OpenPGP subkey to a certificate, a subkey binding signature is calculated over the public primary key, followed by the public subkey.
|
|
||||||
The resulting subkey binding signature (type 0x18) can then be inserted into the certificate right after the subkey.
|
|
||||||
If the subkey itself is intended to be used as a **S**igning key, an extra step is required.
|
|
||||||
To prevent an attacker from being able to "adopt" a victims signing subkey and then being able to claim to be the origin of signatures in fact made by victim, subkey binding signatures for signing subkeys need to include an embedded "back signature" (formally known as primary key binding signature) made by the signing key itself.
|
|
||||||
|
|
||||||
Certifications over user IDs can also be used to certify certificates of third-parties.
|
|
||||||
If Alice is certain that `Bob Baker <bob@example.com>` controls the key 0xB0B, she can create a user ID certification signature for that identity and send it to Bob.
|
|
||||||
Bob can then add this signature to his certificate.
|
|
||||||
TODO: More WoT.
|
|
||||||
|
|
||||||
Another important category of signatures are revocations.
|
|
||||||
A revocation is used to retract the statement formed by a prior signature.
|
|
||||||
A subkey revocation signature revokes a prior subkey binding signature, while a certification revocation revokes a certification signature.
|
|
||||||
Typical use-cases for revocations are marking certificates or individual subkeys as unusable, or marking user IDs as no longer used.
|
|
||||||
|
|
||||||
## Signature Subpackets
|
|
||||||
|
|
||||||
A cryptographic signature alone is often not expressive enough to fulfil certain use-cases.
|
|
||||||
For this reason, the OpenPGP protocol introduced signature subpackets with rfc4880.
|
|
||||||
These are well-defined data structures that can be placed as subelements into signature packets, which give additional context and meaning to a signature.
|
|
||||||
Typical examples are the issuer fingerprint subpacket, which contains the fingerprint of the issuer key, or the key flags subpacket which states, what purpose a component key is intended for.
|
|
||||||
|
|
||||||
Signature subpackets can reside in two different areas of a signature packet.
|
|
||||||
Subpackets in the *hashed area* are incorporated in the digest calculation that is done during signature calculation and are therefore covered by the cryptographic signature.
|
|
||||||
Hashed subpackets are *authenticated*.
|
|
||||||
If a subpacket is placed in the *unhashed area* instead, it is not included in the signature calculation procedure.
|
|
||||||
The unhashed area can be used to retroactively add, change or remove subpackets from a signature without invalidating it.
|
|
||||||
|
|
||||||
Due to the fact that the unhashed area doesn't provide any cryptographic guarantees, it is only intended for advisory packets, or packets that self-authenticate (e.g. issuer key ID / issuer fingerprint subpackets, whose "correctness" can be proven by successfully verifying the signature using the referenced issuer key).
|
|
||||||
In most cases, signature subpackets are simply added into the hashed area.
|
|
||||||
|
|
||||||
Since the hashed and unhashed areas of a signature are just lists of subpackets, in principle they allow duplicates of the same subpacket, which might lead to conflicts.
|
|
||||||
Therefore, packets in the hashed area take precendence over the unhashed area.
|
|
||||||
However, there may still be conflicts between packets in the same area, e.g. two conflicting expiration dates, etc.
|
|
||||||
The specification recommends that implementations favor the last occurence of a conflicting packet.
|
|
||||||
|
|
||||||
In some cases, duplicate packets with conflicting content even make sense, e.g. if a signature was made by a version 6 issuer key whose key material was migrated from an older OpenPGP version such as v4.
|
|
||||||
In this case, the v4 key could be used to validate the v6 signature, but since the fingerprint and key ID calculation scheme was changed between v4 and v6, these identifiers would differ.
|
|
||||||
Therefore, the signature could contain two sets of issuer fingerprint and isuer key ID subpackets with conflicting, but correct values.
|
|
||||||
|
|
||||||
```{admonition} TODO
|
|
||||||
:class: warning
|
|
||||||
|
|
||||||
- Key Flags
|
|
||||||
- Preferences
|
|
||||||
- Embedded Signature (back sig)
|
|
||||||
- Trust Signatures (amount, depth)
|
|
||||||
- Direct key signatures
|
|
||||||
```
|
|
||||||
120
book/source/06-signatures.md
Normal file
120
book/source/06-signatures.md
Normal file
|
|
@ -0,0 +1,120 @@
|
||||||
|
<!--
|
||||||
|
SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
||||||
|
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||||
|
-->
|
||||||
|
|
||||||
|
# OpenPGP Signatures
|
||||||
|
|
||||||
|
Signatures make up the magic of OpenPGP. They act as the syntax that allows forming and interpreting rich statements about certificates and their components, as well as data.
|
||||||
|
|
||||||
|
Without signatures, there would only be loose keys, impossible to associate with a certificate, or their owner. Signatures are the glue that allows for components (component keys and identity components) to be assembled into hierarchical certificates, and for messages to gain authenticity.
|
||||||
|
|
||||||
|
## Terminology
|
||||||
|
|
||||||
|
The term *signature* can have multiple meanings in the context of OpenPGP:
|
||||||
|
|
||||||
|
- Cryptographic keys create raw signatures which are byte sequences calculated according to some signature scheme.
|
||||||
|
- [*OpenPGP signature packets*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-packet-type-id-2), which combine a *type* setting, additional metadata, and a raw cryptographic signature.
|
||||||
|
|
||||||
|
For the purpose of this document, the term signature will refer to OpenPGP signature packets.
|
||||||
|
|
||||||
|
```{admonition} VISUAL
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
show our visuals for these two layers of meaning?
|
||||||
|
|
||||||
|
- "sig-circle", vs
|
||||||
|
- box with yellow tag-thing, including sig-circle
|
||||||
|
```
|
||||||
|
|
||||||
|
(signature_types)=
|
||||||
|
## Types of signatures in OpenPGP
|
||||||
|
|
||||||
|
The OpenPGP standard defines a set of [Signature Types](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-types), each identified by a numerical *signature type ID*. Signature types define the intent of a signature, and how it needs to be interpreted.
|
||||||
|
|
||||||
|
```{figure} mermaid/06-terminology.png
|
||||||
|
|
||||||
|
An overview of signature types in OpenPGP
|
||||||
|
```
|
||||||
|
|
||||||
|
Most OpenPGP signature types can be classified as either:
|
||||||
|
|
||||||
|
- *Signatures over data*, or
|
||||||
|
- *Signatures on components* (that is: signatures that apply to component keys or identity components).
|
||||||
|
|
||||||
|
In this chapter, we discuss the general principles of OpenPGP signatures, which apply to all types of OpenPGP signatures.
|
||||||
|
|
||||||
|
For more detail about specific types of signatures, see the chapters {ref}`signing_data` and {ref}`component_signatures_chapter`, respectively.
|
||||||
|
|
||||||
|
## Structure of an OpenPGP signature
|
||||||
|
|
||||||
|
As outlined above, an OpenPGP signature is a composite data structure, which combines:
|
||||||
|
|
||||||
|
- A *signature type ID* (see above), which specifies the intended meaning of the signature,
|
||||||
|
- Metadata (which is variable and depends in part on the type ID),
|
||||||
|
- Most of this metadata is encoded as so-called "subpackets," see {ref}`signature_subpackets`,
|
||||||
|
- A raw cryptographic signature.
|
||||||
|
|
||||||
|
|
||||||
|
```{admonition} VISUAL
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
show a version of our "yellow tag-thing with sig-circle" visual?
|
||||||
|
```
|
||||||
|
|
||||||
|
The cryptographic signature is calculated by its issuer. It certifies a hash digest, which in turn combines a set of input data. The exact input data depends on the signature type. Roughly: the hash digest is over the elements that the OpenPGP signature makes a statement about, combined with the metadata in the OpenPGP signature packet itself. More on this later.
|
||||||
|
|
||||||
|
(signature_subpackets)=
|
||||||
|
## Signature subpackets
|
||||||
|
|
||||||
|
Just a cryptographic signature, combined with a signature type identifier, is often not sufficiently expressive. For this reason, the OpenPGP protocol introduced signature subpackets (in [RFC 2440](https://datatracker.ietf.org/doc/html/rfc2440)).
|
||||||
|
|
||||||
|
Subpackets are well-defined data structures that can be placed into signature packets as subelements. They give additional context and meaning to a signature. Subpackets encode data in a key-value format. All possible keys are defined in the RFC as [subpacket type IDs](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-subpacket-types-r), and the value format (and meaning) are defined in the RFC for each subpacket type ID.
|
||||||
|
|
||||||
|
Typical examples are:
|
||||||
|
- the [*issuer fingerprint*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#issuer-fingerprint-subpacket) subpacket, which contains the fingerprint of the issuer key, or
|
||||||
|
- the [*key flags*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags) subpacket which defines what purpose a component key is used for, in a certificate.
|
||||||
|
|
||||||
|
Signature subpackets can reside in two different areas of a signature packet:
|
||||||
|
|
||||||
|
- Subpackets in the *hashed area* are incorporated in the digest calculation that is done during signature calculation and are therefore covered by the cryptographic signature. In other words; hashed subpackets are *authenticated*.
|
||||||
|
- If a subpacket is placed in the *unhashed area* instead, it is not included in the signature calculation procedure and is therefore not protected against tampering. The unhashed area can be used to retroactively add, change or remove subpackets from a signature without invalidating it. Since the unhashed area doesn't provide any cryptographic guarantees, it is only intended for advisory packets, or packets that self-authenticate (e.g. the issuer fingerprint subpacket, whose "correctness" can be proven by successfully verifying the signature using the referenced issuer key).
|
||||||
|
|
||||||
|
In most cases, signature subpackets are stored in the hashed area.
|
||||||
|
|
||||||
|
### Criticality of subpackets
|
||||||
|
|
||||||
|
Each signature subpacket has a flag that indicates whether the subpacket is *critical*.
|
||||||
|
|
||||||
|
Since different OpenPGP implementations might support subsets of the standard, it would be fatal if, for example, an implementation did not understand the concept of signature expiration. Such an implementation would potentially accept an already expired signature.
|
||||||
|
By marking the expiration date subpacket as critical, the user can indicate that implementations that do not understand this type of subpacket are supposed to reject the signature as invalid.
|
||||||
|
|
||||||
|
RFC Sections [5.2.3.11](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-creation-time) - [5.2.3.36](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-intended-recipient-fingerpr) give guidance on which subpackets are usually marked as critical.
|
||||||
|
|
||||||
|
## Advanced topics
|
||||||
|
|
||||||
|
### Notation signature subpackets
|
||||||
|
|
||||||
|
[Notations](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#notation-data) are a signature subpacket type that can be used to effectively extend the otherwise limited set of signature subpacket types with user-defined notations. An issuer can use notations to add name-value data to an OpenPGP signature.
|
||||||
|
|
||||||
|
Notation names are UTF-8 encoded strings. They may reside in the "user namespace," which means a notation *tag* (in UTF-8 string format) followed by a DNS domain name.
|
||||||
|
|
||||||
|
#### Use of notations by Keyoxide
|
||||||
|
|
||||||
|
Notations have, for example, been used for the popular decentralized identity verification service [Keyoxide](https://keyoxide.org/). Keyoxide uses notations in the `ariadne.id` namespace. See the [Keyoxide documentation](https://docs.keyoxide.org/wiki/ariadne-identity/) for more details.
|
||||||
|
|
||||||
|
### "Negotiating" signature hash algorithm based on recipients preference subpackets
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
investigate, discuss: GnuPG uses preference packets for the User ID that was addressed while sequoia completely omits User ID preferences and either uses Direct Key Sigs or (I think) primary User ID.
|
||||||
|
```
|
||||||
|
|
||||||
|
### Explore viability of having multiple signatures, e.g. v4+v6?
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
C-R 5.2. says: An implementation MUST generate a version 6 signature when signing with a version 6 key. An implementation MUST generate a version 4 signature when signing with a version 4 key.
|
||||||
|
```
|
||||||
|
|
@ -6,13 +6,72 @@ SPDX-License-Identifier: CC-BY-SA-4.0
|
||||||
(signing_data)=
|
(signing_data)=
|
||||||
# Signatures over data
|
# Signatures over data
|
||||||
|
|
||||||
```{admonition} TODO
|
A data signature guarantees the authenticity (and implicitly also the integrity) of a message, e.g., an email or a file.
|
||||||
:class: warning
|
|
||||||
|
|
||||||
Add content, including:
|
Note that signatures over data are different from {ref}`component_signatures_chapter`, which are used to attach metadata or subkeys to a certificate.
|
||||||
|
|
||||||
- Signature of a binary document
|
One major use case for OpenPGP is to create signatures for software packages or emails. These are examples for signatures over data, with OpenPGP.
|
||||||
|
|
||||||
- Signature of a canonical text document
|
When signing data, OpenPGP offers the advantage that it comes with mechanisms for strong authentication, based on bindings between certificates and identities, and the option to certify those bindings.
|
||||||
- "The signature is calculated over the text data with its line endings converted to `<CR><LF>`"
|
|
||||||
```
|
Other signing solutions, like [signify](https://flak.tedunangst.com/post/signify), typically only offer a solution for pure signing, without offering
|
||||||
|
a mechanism for authentication.
|
||||||
|
|
||||||
|
## Signature types
|
||||||
|
|
||||||
|
Two OpenPGP [signature types](signature_types) apply to data signatures:
|
||||||
|
|
||||||
|
- Signature of a binary document (*Binary Signature*, type ID `0x00`): a universal signature type for binary data. This signature type is typically used for files or data streams.
|
||||||
|
Binary signatures are calculated over the data "as is", without performing any transformations.
|
||||||
|
- Signature of a canonical text document (*Text Signature*, type ID `0x01`): used for textual data, such as email bodies. When calculating a text signature, the data is first normalized by converting line endings into a canonical form (`<CR><LF>`). This normalization mitigates issues caused by platform-specific default text encodings.
|
||||||
|
(This can be useful for detached signatures, when the message file may get re-encoded between signature generation and validation)
|
||||||
|
|
||||||
|
Data signatures are always calculated by a component key that carries the *signing* key flag.
|
||||||
|
|
||||||
|
Data signatures are created by hashing the message content and calculating a cryptographic signature over the hash.
|
||||||
|
The resulting cryptographic signature is stored in an OpenPGP signature packet, which can be used in different ways:
|
||||||
|
|
||||||
|
## Forms of OpenPGP data signatures
|
||||||
|
|
||||||
|
OpenPGP signatures over data can be generated and distributed in three forms[^sign-modes-gpg]:
|
||||||
|
|
||||||
|
- *Detached*: The signature is a standalone artifact, separate from the signed data.
|
||||||
|
- *Inline*: The original data and the signature over the data are stored in an OpenPGP container.
|
||||||
|
- *Cleartext signature*: A method to sign text while leaving the original message in a human-readable format.
|
||||||
|
|
||||||
|
[^sign-modes-gpg]: These signature forms correspond with GnuPG's `--detach-sign`, `--sign` and `--clear-sign` modes.
|
||||||
|
|
||||||
|
### Detached signatures
|
||||||
|
|
||||||
|
A detached signature is produced by calculating an OpenPGP signature over a piece of data.
|
||||||
|
The resulting OpenPGP signature packet can then be distributed alongside or independent of the original data.
|
||||||
|
|
||||||
|
This method is especially useful for signing software releases and other files that must not be modified by the signing process.
|
||||||
|
|
||||||
|
### Inline signatures
|
||||||
|
|
||||||
|
This method is usually used with signed and/or encrypted emails.
|
||||||
|
|
||||||
|
Most clients that support OpenPGP for encrypted and/or signed messages make use of inline-signatures.
|
||||||
|
To produce a signature, the entirety of the data needs to be processed by the producer. This has the consequence that an application that efficiently emits signed data can only append the signature at the end of the data stream.
|
||||||
|
On the other hand, an application that needs to efficiently verify signed data needs to know the signer's public key and used hash algorithm before processing the data.
|
||||||
|
To solve this issue, so-called One-Pass-Signature packets are prefixed to the signed data. Those are small packets containing the fingerprint of the signing key, as well as the used hash algorithm. This is all the information a receiving application needs to know to initiate the verification process.
|
||||||
|
|
||||||
|
To produce an inline-signed message, the original data is first wrapped in a Literal Data packet, which is prefixed with one or more One-Pass-Signature packets, and affixed with the corresponding signature packets.
|
||||||
|
The verifying application can read the One-Pass-Signature packets and initiate the verification process.
|
||||||
|
The literal data can then be processed, such that the signatures at the end of the message can be verified in *one pass*.
|
||||||
|
|
||||||
|
TODO: explain nesting of OPSs.
|
||||||
|
|
||||||
|
### Cleartext signatures
|
||||||
|
|
||||||
|
The *Cleartext Signature Framework* (CSF) is a mechanism that combines two goals:
|
||||||
|
|
||||||
|
- It leaves the message in clear text format, so that it can be viewed directly by a human in a program that knows nothing about OpenPGP.
|
||||||
|
- But also adds an OpenPGP signature that allows verification of that message by users whose software supports OpenPGP.
|
||||||
|
|
||||||
|
TODO: explain text transforms for cleartext signatures (LF->CRLF etc)
|
||||||
|
|
||||||
|
#### Pitfalls
|
||||||
|
|
||||||
|
The RFC points out a number of [pitfalls of cleartext signatures](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-issues-with-the-cleartext-s), and advises that in many cases, the inline and detached signature forms are preferable.
|
||||||
|
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
<!--
|
|
||||||
SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|
||||||
SPDX-License-Identifier: CC-BY-SA-4.0
|
|
||||||
-->
|
|
||||||
|
|
||||||
# Signature "internals"
|
|
||||||
|
|
||||||
```{admonition} TODO
|
|
||||||
:class: warning
|
|
||||||
|
|
||||||
- Subpackets and how to make sense of them
|
|
||||||
- "Negotiating" signature hash algorithm based on recipients preference subpackets
|
|
||||||
- Explore viability of having multiple signatures, e.g. v4+v6?
|
|
||||||
```
|
|
||||||
|
|
||||||
## Notations
|
|
||||||
|
|
||||||
## Zooming in: Packet structure
|
|
||||||
340
book/source/08-signing_components.md
Normal file
340
book/source/08-signing_components.md
Normal file
|
|
@ -0,0 +1,340 @@
|
||||||
|
<!--
|
||||||
|
SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
||||||
|
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||||
|
-->
|
||||||
|
|
||||||
|
(certifications_chapter)=
|
||||||
|
|
||||||
|
# Signatures on components
|
||||||
|
|
||||||
|
In this chapter, we'll consider OpenPGP signatures that apply to components. That is, signatures that apply to:
|
||||||
|
|
||||||
|
- Component keys (primary keys or subkeys), or
|
||||||
|
- Identity components (User IDs or User attributes).
|
||||||
|
|
||||||
|
This chapter adds a lot of detail to the material we discussed in the {ref}`certificates_chapter` chapter. Signatures on components are a crucial mechanism for forming OpenPGP certificates (which combine component keys and identities, via signatures on those components).
|
||||||
|
|
||||||
|
Additionally, signatures on components play a crucial role for authentication of identities. Mechanisms for decentralized authentication are one of OpenPGP's core strenghts, we'll look into how they work.
|
||||||
|
|
||||||
|
Finally, signatures on components are also a central mechanism for life-cycle management of OpenPGP certificates and their components. This includes defining or changing expiration dates, or issuing revocations, for certificates or their components.
|
||||||
|
|
||||||
|
## Self-signatures and third-party signatures
|
||||||
|
|
||||||
|
There are two important scenarios to distinguish:
|
||||||
|
|
||||||
|
- *Self-signatures*: Issued by the certificate's owner, using the primary key of the same certificate.
|
||||||
|
- *Third-party signatures*: Issued by a key that is part of a different certificate.
|
||||||
|
|
||||||
|
### Meaning differs between self- and third-party signatures
|
||||||
|
|
||||||
|
The meaning of a signature depends in part on who issued it. A self-signature often has a different meaning from a signature issued by a third party.
|
||||||
|
|
||||||
|
For example:
|
||||||
|
|
||||||
|
- A [direct key signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) issued as a self-signature can be used to set preferences and advertise features that apply to the whole certificate, while
|
||||||
|
- A similar [direct key signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) issued by a third party, which carries a [trust signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-trust-signature) subpacket, acts as a statement by the issuer that they delegate trust to the signed certificate (the issuer thereby uses the remote certificate as a trust root in the *Web of Trust*).
|
||||||
|
|
||||||
|
Or:
|
||||||
|
|
||||||
|
- Certifying self-signatures (type IDs `0x10` - `0x13`) are used to bind a User ID to a certificate, while
|
||||||
|
- the same signature type IDs issued by a third party are statements by the signer that they endorse the authenticity of the signed User ID to some degree.
|
||||||
|
|
||||||
|
There are further signature types for signatures on data, as well as designated types to bind and revoke subkeys.
|
||||||
|
|
||||||
|
## Signatures on components
|
||||||
|
|
||||||
|
A typical use-case for a self-signature is to attach a User ID, such as a name and email address to a certificate.
|
||||||
|
This is done by calculating the signature over the User ID and the public primary key.
|
||||||
|
The resulting User ID certification (typically type 0x13, potentially type 0x10-0x12) can then be inserted into the certificate, right after the User ID packet.
|
||||||
|
|
||||||
|
Other examples for self-signatures are binding signatures for subkeys. To add an OpenPGP subkey to a certificate, a subkey binding signature is calculated over the public primary key, followed by the public subkey.
|
||||||
|
The resulting subkey binding signature (type 0x18) can then be inserted into the certificate right after the subkey.
|
||||||
|
If the subkey itself is intended to be used as a **S**igning key, an extra step is required.
|
||||||
|
To prevent an attacker from being able to "adopt" a victims signing subkey and then being able to claim to be the origin of signatures in fact made by victim, subkey binding signatures for signing subkeys need to include an embedded "back signature" (formally known as [primary key binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#sigtype-primary-binding)) made by the signing key itself.
|
||||||
|
|
||||||
|
Certifications over User IDs can also be used to certify certificates of third-parties.
|
||||||
|
If Alice is certain that `Bob Baker <bob@example.com>` controls the key `0xB0B`, she can create a User ID certification signature for that identity and send it to Bob.
|
||||||
|
Bob can then add this signature to his certificate.
|
||||||
|
TODO: More WoT.
|
||||||
|
|
||||||
|
```{note}
|
||||||
|
The **certify others** key flag is not required in order to issue certifying self-signatures.
|
||||||
|
This key flag is only necessary to issue valid third-party certifications.
|
||||||
|
```
|
||||||
|
|
||||||
|
### Revocations
|
||||||
|
|
||||||
|
One important class of self-signatures are revocations.
|
||||||
|
|
||||||
|
A revocation signature is used to retract the statement formed by a prior signature.
|
||||||
|
A subkey revocation signature revokes a prior subkey binding signature, while a certification revocation revokes a certification signature.
|
||||||
|
Typical use-cases for revocations are marking certificates or individual subkeys as unusable (for example, when the private key has been compromised or superseded), or marking User IDs as no longer used.
|
||||||
|
|
||||||
|
A revocation signature can either be hard or soft. A soft revocation of a certificate invalidates it from the revocation signature's creation time onwards. This means signatures issued before the revocation remain intact. A hard revocation, by contrast, invalidates the certificate retroactively, rendering all issued signatures invalid, regardless of creation time. Soft revocations are typically used whenever a key or User ID is retired or superseded gracefully, while hard revocations can, for example, signal compromise of secret key material.
|
||||||
|
|
||||||
|
## Self-signatures: Linking the components of a certificate
|
||||||
|
|
||||||
|
So far we've looked at the components in an OpenPGP certificate, but certificates actually contain another set of elements, which bind the components together, and add metadata to them.
|
||||||
|
|
||||||
|
Internally, an OpenPGP certificate consists of a sequence of OpenPGP packets. These packets are just stringed together, one after the other. When a certificate is stored in a file[^tpk], it's easy to remove some of these packets, or add new ones.
|
||||||
|
|
||||||
|
[^tpk]: When stored in a file, OpenPGP certificates are in a format called [transferable public key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-transferable-public-keys).
|
||||||
|
|
||||||
|
However, the owner of a certificate doesn't want a third party to add subkeys (or add [identity components](identity_components)) to their certificate, pretending that the certificate owner put those components there.
|
||||||
|
|
||||||
|
To prevent malicious addition of components, OpenPGP uses cryptographic signatures. These signatures show that components have been added by the owner of the OpenPGP certificate (these linking signatures are issued by the primary key of the certificate).
|
||||||
|
|
||||||
|
So while anyone can still unilaterally store unrelated subkeys and [identity components](identity_components) in an OpenPGP certificate dataset, OpenPGP implementations that read this certificate should discard components that don't have a valid cryptographic connection with the certificate.
|
||||||
|
|
||||||
|
(Conversely, it's easy for a third party to leave out packets when passing on an OpenPGP certificate. An attacker can, for example, choose to omit revocation packets. The recipient of such a partial copy has no way to notice the omission, without access to a different source for the certificate that contains the revocation packet.)
|
||||||
|
|
||||||
|
Note, though, that there are some cases where third parties legitimately add "unbound" packets to certificates (that is: packets that are not signed by the certificate's owner):
|
||||||
|
|
||||||
|
- [Third-party certifications](third_party_cert) are traditionally added to the certificate that they make a statement about (this can cause problems in systems that unconditionally accept and include such certifications[^flooding]),
|
||||||
|
- OpenPGP software may add [unbound identity data](unbound_user_ids), locally.
|
||||||
|
|
||||||
|
[^flooding]: Storing third-party identity certifications in the target OpenPGP certificate is convenient for consumers: it is easy to find all relevant certifications in one central location. However, when third parties can unilaterally add certifications, this opens an avenue for denial-of-service attacks by flooding. The SKS network of OpenPGP key servers [allowed and experienced this problem](https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html).
|
||||||
|
|
||||||
|
### Binding subkeys to a certificate
|
||||||
|
|
||||||
|
Linking a subkey to an OpenPGP certificate is done with a ["Subkey Binding Signature"](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-subkey-binding). Such a signature signals that the "primary key wants to be associated with the subkey".
|
||||||
|
|
||||||
|
The subkey binding signature also adds metadata.
|
||||||
|
|
||||||
|
```{figure} diag/subkey_binding_signature.png
|
||||||
|
|
||||||
|
Linking an OpenPGP subkey to the primary key with a binding signature
|
||||||
|
```
|
||||||
|
|
||||||
|
The [Signature packet](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-signature-packet-tag-2) that binds the subkey to the primary key has the signature type [SubkeyBinding](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-subkey-binding-signature-si).
|
||||||
|
|
||||||
|
|
||||||
|
In order to specify an expiration time for the subkey, a key expiration time subpacket can be included. Note, that the validity of the subkey is bounded by that of the primary key, meaning an expired primary key causes the subkey to be invalidated, no matter the subkey expiration time.
|
||||||
|
|
||||||
|
Note, that a subkey cannot be "older" than the primary key. The value of the subkeys creation date MUST be greater than that of the primary key.
|
||||||
|
|
||||||
|
### Special case: Binding signing subkeys to a certificate
|
||||||
|
|
||||||
|
Binding subkeys with the "signing" key flag is a special case. For the most part, it works the same as binding other types of subkeys, but there is an additional requirement:
|
||||||
|
|
||||||
|
When binding a signing subkey to a primary key, it is not sufficient that the "primary key wants to be associated with the subkey." In addition, the subkey must signal that it "wants to be associated with that primary key."
|
||||||
|
|
||||||
|
Otherwise, Alice could "adopt" Bob's signing subkey and convincingly claim that she made signatures that were in fact issued by Bob.
|
||||||
|
This is to prevent an attack where the attacker "adopts" the victims signing subkey as their own in order to claim ownership over documents which were in fact signed by the victim.
|
||||||
|
Contrary to the `SubkeyBinding` signature, which is issued by the certificates primary key, the `PrimaryKeyBinding` signature is instead created by the subkey.
|
||||||
|
|
||||||
|
```{figure} diag/subkey_binding_signatur_for_signing_sk.png
|
||||||
|
|
||||||
|
Linking an OpenPGP signing subkey to the primary key with a binding signature, and an embedded primary key binding signature
|
||||||
|
```
|
||||||
|
|
||||||
|
This additional "Primary Key Binding" Signature is informally called a "back signature" (because the subkey uses the signature to point "back" to the primary key) is an embedded `PrimaryKeyBinding` "back signature" (type 0x19).
|
||||||
|
|
||||||
|
|
||||||
|
### Binding identities to a certificate
|
||||||
|
|
||||||
|
"User ID" identity components are bound to an OpenPGP certificate by issuing a self-signature ("User Attributes" work analogously).
|
||||||
|
|
||||||
|
For example, the User ID `Alice Adams <alice@example.org>` may be associated with Alice's certificate `AAA1 8CBB 2546 85C5 8358 3205 63FD 37B6 7F33 00F9 FB0E C457 378C D29F 1026 98B3`.
|
||||||
|
|
||||||
|
Alice can link a User ID to her OpenPGP certificate with a cryptographic signature. To link a User ID, a self-signature is created (usually with the signature type [PositiveCertification](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-positive-cert)). This signature is issued by the primary key.
|
||||||
|
|
||||||
|
```{figure} diag/user_id_certification.png
|
||||||
|
---
|
||||||
|
---
|
||||||
|
Linking a User ID to an OpenPGP certificate
|
||||||
|
```
|
||||||
|
|
||||||
|
This signature is calculated over the primary key and User ID.
|
||||||
|
|
||||||
|
|
||||||
|
(direct_key_signature)=
|
||||||
|
### Direct key signature: Adding metadata to the primary key
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
explain metadata associated with this signature, and that c-r prefers this over primary user id.
|
||||||
|
```
|
||||||
|
|
||||||
|
### Revocations: Invalidating components of a certificate
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
This section only contains notes and still needs to be written
|
||||||
|
```
|
||||||
|
|
||||||
|
Note: certification signatures [can be made irrevocable](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-revocable).
|
||||||
|
|
||||||
|
#### Hard vs. soft revocations
|
||||||
|
|
||||||
|
A revocation signature may contain a subpacket indicating the reason for revocation. This subpacket contains a code which specifies why the revocation was issued. This code determines, whether the revocation is hard or soft.
|
||||||
|
|
||||||
|
A soft revocation is typically used for graceful or planned revocations. A soft revocation can be reverted by re-validating the certificate, User ID or subkey with a fresh binding signature.
|
||||||
|
A soft revocation invalidates the target certificate beginning with the revocations creation time.
|
||||||
|
|
||||||
|
Contrary, a hard revocation cannot be re-validated. Furthermore, a hard-revoked certificate is invalidated retroactively.
|
||||||
|
|
||||||
|
A missing revocation reason subpacket is equivalent with a hard revocation reason.
|
||||||
|
|
||||||
|
## Third-party signatures: Making statements about other people's certificates and identities
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
write
|
||||||
|
```
|
||||||
|
|
||||||
|
## Advanced topics
|
||||||
|
|
||||||
|
### Certification Recipes
|
||||||
|
|
||||||
|
As mentioned above, different signatures are used for different purposes.
|
||||||
|
In this section, we will try to give guidance on how to create certain signatures by example.
|
||||||
|
|
||||||
|
#### Change Algorithm Preferences
|
||||||
|
|
||||||
|
In order to change what symmetric, compression, hash or AEAD algorithms are preferred by the key owner, they can issue a direct-key signature (type 0x1F) on the primary key.
|
||||||
|
This signature should have the following structure:
|
||||||
|
|
||||||
|
| Subpacket | Area | Critical | Mandatory | Notes |
|
||||||
|
|-----------|------|----------|-----------|-------|
|
||||||
|
| Signature Creation Time | Hashed | True | True | Current time |
|
||||||
|
| Issuer Fingerprint | Hashed | True or false | Strongly recommended | The primary key is the issuer |
|
||||||
|
| Key Flags | Hashed | True | False | Carry over key flags from previous self-signature |
|
||||||
|
| Features | Hashed | True | False | Carry over features from previous self-signature |
|
||||||
|
| Key Expiration Time | Hashed | True | False | Carry over expiration time from previous self-signature, if present |
|
||||||
|
| Hash Alg. Pref. | Hashed | False | False | New preferences |
|
||||||
|
| Comp. Alg. Pref. | Hashed | False | False | New preferences |
|
||||||
|
| Symm. Alg. Pref. | Hashed | False | False | New preferences |
|
||||||
|
| AEAD Alg. Pref. | Hashed | False | False | New preferences |
|
||||||
|
|
||||||
|
#### Change Expiration Time
|
||||||
|
|
||||||
|
The recommended way to change the expiration time of a certificate is by issuing a new `DirectKey` signature (type 0x1F) with an adjusted Key Expiration Time subpacket.
|
||||||
|
The structure of such a signature is the same as in the section above.
|
||||||
|
It is also possible to change the expiration date of individual User IDs (see section below) or separate subkeys (see [section X](#add_subkey)).
|
||||||
|
|
||||||
|
#### Add User ID
|
||||||
|
|
||||||
|
A signature that binds a User ID to a certificate should have the following structure:
|
||||||
|
|
||||||
|
| Subpacket | Area | Critical | Mandatory | Notes |
|
||||||
|
|-----------|------|----------|-----------|-------|
|
||||||
|
| Signature Creation Time | Hashed | True | True | Current time |
|
||||||
|
| Issuer Fingerprint | Hashed | True or false | Strongly Recommended | The primary key is the issuer |
|
||||||
|
| Primary User ID | Hashed | True | False | Optional |
|
||||||
|
| Signature Expiration Time | Hashed | True | False | Optional |
|
||||||
|
|
||||||
|
Self-certifications over User IDs can optionally carry the same subpackets as listed in the previous table (key flags, features, algorithm preferences).
|
||||||
|
This way, separate capabilities can be assigned to different identities.
|
||||||
|
|
||||||
|
#### Remove / Revoke User ID
|
||||||
|
|
||||||
|
Since OpenPGP certificates are often distributed by the means of key servers, new signatures on a certificate are often "merged" into existing copies of the certificate locally by the recipient.
|
||||||
|
This means, that it is not really possible to remove signatures / User IDs from a certificate, as there is no way to communicate the intention of packet deletion to the recipient.
|
||||||
|
|
||||||
|
So to mark a User ID as invalid, the user can publish a copy of their certificate with a `CertificationRevocation` (signature type 0x30) attached to the invalidated User ID.
|
||||||
|
This signature signals that the holder of the certificate no longer wants to be associated with that User ID.
|
||||||
|
|
||||||
|
The structure of a certification revocation is as follows:
|
||||||
|
|
||||||
|
| Subpacket | Area | Critical | Mandatory | Notes |
|
||||||
|
|-----------|------|----------|-----------|-------|
|
||||||
|
| Signature Creation Time | Hashed | True | True | Current time |
|
||||||
|
| Issuer Fingerprint | Hashed | True or false | Strongly Recommended | The primary key is the issuer |
|
||||||
|
| Reason for Revocation | Hashed | True | False | Decides over soft / hard revocation |
|
||||||
|
|
||||||
|
For User ID revocations, the value of the reason subpacket can either be `0` (no reason specified) or `32`, signaling that the User ID is no longer valid.
|
||||||
|
The latter would result in a soft revocation, while a reason code of `0` is considered a hard revocation.
|
||||||
|
Omitting the reason packet altogether is also equivalent to a hard revocation.
|
||||||
|
It is recommended to issue User ID certifications using a reason code `32` and to do certificate revocations using a direct-key signature.
|
||||||
|
|
||||||
|
(binding_subkeys)=
|
||||||
|
#### Add a Subkey
|
||||||
|
|
||||||
|
For the purpose of key freshness, a user might want to add a new subkey to their certificate.
|
||||||
|
|
||||||
|
|
||||||
|
The structure is as follows:
|
||||||
|
|
||||||
|
| Subpacket | Area | Critical | Mandatory | Notes |
|
||||||
|
|-----------|------|----------|-----------|-------|
|
||||||
|
| Signature Creation Time | Hashed | True | True | Current time |
|
||||||
|
| Issuer Fingerprint | Hashed | True or false | Strongly Recommended | The primary key is the issuer |
|
||||||
|
| Key Flags | Hashed | True | Strongly Recommended | Determine the usage of the key |
|
||||||
|
| Key Expiration Time | Hashed | True | False | Specifies the expiration date of the subkey |
|
||||||
|
| Embedded Signature | Hashed | True | If Key Flags contains **S** | Signing subkeys require embedded `PrimaryKeyBinding` signature |
|
||||||
|
| Hash Alg. Pref. | Hashed | False | False | Per key preferences |
|
||||||
|
| Comp. Alg. Pref. | Hashed | False | False | Per key preferences |
|
||||||
|
| Symm. Alg. Pref. | Hashed | False | False | Per key preferences |
|
||||||
|
| AEAD Alg. Pref. | Hashed | False | False | Per key preferences |
|
||||||
|
|
||||||
|
Optional algorithm preference subpackets can be used to signal per-subkey preferences that deviate from those set in the certificates `DirectKey` signature.
|
||||||
|
|
||||||
|
#### Revoke a Subkey
|
||||||
|
|
||||||
|
Analogous to User IDs, subkeys can be revoked individually.
|
||||||
|
This is done by issuing a `SubkeyRevocation` signature (type 0x28) using the primary key.
|
||||||
|
The structure of such a signature is rather minimal:
|
||||||
|
|
||||||
|
| Subpacket | Area | Critical | Mandatory | Notes |
|
||||||
|
|-----------|------|----------|-----------|-------|
|
||||||
|
| Signature Creation Time | Hashed | True | True | Current time |
|
||||||
|
| Issuer Fingerprint | Hashed | True or false | Strongly Recommended | The primary key is the issuer |
|
||||||
|
| Reason for Revocation | Hashed | True | False | Decides over soft / hard revocation |
|
||||||
|
|
||||||
|
In `SubkeyRevocation` signatures, the reason subpacket cannot have value `32`, but instead may be from the range of `0-3`.
|
||||||
|
Values `1` (key superseded) and `3` (key retired and no longer used) are soft reasons, while `0` (no reason) and `2` (key compromised) are considered hard.
|
||||||
|
|
||||||
|
#### Revoke a Certificate
|
||||||
|
|
||||||
|
A user might want to revoke their whole certificate, rendering it unusable.
|
||||||
|
Depending on the circumstances, they might either want to revoke it softly, e.g. in case of migration to a new certificate, or they want to issue a hard revocation, e.g. in case of secret key material compromise. A soft-revoked certificate can be re-validated at a later point in time, by issuing a new certification, while a hard revocation is typically permanent.
|
||||||
|
|
||||||
|
The recommended way to revoke a certificate is by issuing a `KeyRevocation` signature (type 0x20).
|
||||||
|
The structure of a key revocation signature is similar to that of a `CertificationRevocation` signature.
|
||||||
|
|
||||||
|
| Subpacket | Area | Critical | Mandatory | Notes |
|
||||||
|
|-----------|------|----------|-----------|-------|
|
||||||
|
| Signature Creation Time | Hashed | True | True | Current time |
|
||||||
|
| Issuer Fingerprint | Hashed | True or false | Strongly Recommended | The primary key is the issuer |
|
||||||
|
| Reason for Revocation | Hashed | True | False | Decides over soft / hard revocation |
|
||||||
|
|
||||||
|
For `KeyRevocation` signatures, the same constraints as for `SubkeyRevocation` signatures apply to the reason subpacket.
|
||||||
|
|
||||||
|
#### Common Subpackets
|
||||||
|
|
||||||
|
There are some subpackets that are expected to be included in any type of signature.
|
||||||
|
|
||||||
|
* **Signature Creation Time**: Every OpenPGP signature MUST contain a Signature Creation Time subpacket (2) containing the timestamp at which the signature was made. This packet MUST be present in the hashed area of the signature and SHOULD be marked as critical.
|
||||||
|
|
||||||
|
* **Issuer Fingerprint**: To be able to verify a signature, the verifier needs to know which (sub-)key was used to issue the signature in the first place. Therefore, every OpenPGP v6 signature SHOULD contain an Issuer Fingerprint subpacket (33) containing the 32 byte fingerprint of the particular component key that was used to create the signature.
|
||||||
|
|
||||||
|
```{note}
|
||||||
|
The issuer key might be a subkey.
|
||||||
|
```
|
||||||
|
|
||||||
|
Since the issuer fingerprint subpacket is self-authenticating, it can either be included as a hashed or unhashed subpacket, but the authors of this book recommend to place it in the hashed area of the signature.
|
||||||
|
|
||||||
|
### Potential subpacket conflicts and duplication
|
||||||
|
|
||||||
|
Since the hashed and unhashed areas of a signature are just lists of subpackets, in principle they allow duplicates of the same subpacket, which might lead to conflicts.
|
||||||
|
Therefore, packets in the hashed area take precedence over the unhashed area.
|
||||||
|
However, there may still be conflicts between packets in the same area, e.g., two conflicting expiration dates, etc.
|
||||||
|
The [specification recommends](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-notes-on-subpackets) that implementations favor the last occurrence of a conflicting packet in the hashed area.
|
||||||
|
|
||||||
|
In some cases, duplicate packets with conflicting content even make sense, e.g., if a signature was made by a version 4 issuer key whose key material was migrated from an older OpenPGP version such as v3.
|
||||||
|
In this case, either the v3 or v4 key could be used to validate the v4 signature, but since the key ID calculation scheme was changed between v3 and v4, these identifiers would differ.
|
||||||
|
Therefore, the signature could contain two isuer key ID subpackets with conflicting, but correct values.
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
- Key Flags
|
||||||
|
- Preferences
|
||||||
|
- Embedded Signature (back sig)
|
||||||
|
- Trust Signatures (amount, depth)
|
||||||
|
- Direct key signatures
|
||||||
|
```
|
||||||
|
|
@ -3,4 +3,229 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
||||||
SPDX-License-Identifier: CC-BY-SA-4.0
|
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||||
-->
|
-->
|
||||||
|
|
||||||
|
(zoom_sign_data)=
|
||||||
# Zooming in: Packet structure of data signatures
|
# Zooming in: Packet structure of data signatures
|
||||||
|
|
||||||
|
In this chapter, we'll create signatures using [Alice's private key](alice_priv) material, and inspect the packet structure of those signatures.
|
||||||
|
|
||||||
|
In some examples, we'll use a test-message that contains the string `hello world` followed by one line feed (`0x0a`) character:
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ echo "hello world" > message.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
## Detached signature
|
||||||
|
|
||||||
|
We can produce a detached signature for this "hello world" message, using Alice's private signing key material:
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ sq sign --detached --signer-file alice.pgp message.txt
|
||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
wpgGABsKAAAAKQWCZT0tDyIhBtB7JOyRoU3SQKwtU+bIqeBUlJpBIi6nOFdu0Zyu
|
||||||
|
o9yZAAAAANueIJCkVJ5aC1Zw485o7Y72uHPnk7ktkZyhKH2MuHjCdIHQU0qe/8bR
|
||||||
|
0B3ywHNzLwUoqj0efYWhj6XeXa08haxUH7i50MEDjfFrPc281B0C5fiiGN4PYc76
|
||||||
|
B8tA2/ZjsSgHCw==
|
||||||
|
=n8EV
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
|
```
|
||||||
|
|
||||||
|
And inspect the packet structure of this signature:
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ sq packet dump --hex detached-sig.txt
|
||||||
|
Signature Packet, new CTB, 2 header bytes + 152 bytes
|
||||||
|
Version: 6
|
||||||
|
Type: Binary
|
||||||
|
Pk algo: Ed25519
|
||||||
|
Hash algo: SHA512
|
||||||
|
Hashed area:
|
||||||
|
Signature creation time: 2023-10-28 15:47:27 UTC (critical)
|
||||||
|
Issuer Fingerprint: D07B24EC91A14DD240AC2D53E6C8A9E054949A41222EA738576ED19CAEA3DC99
|
||||||
|
Digest prefix: DB9E
|
||||||
|
Level: 0 (signature over data)
|
||||||
|
|
||||||
|
00000000 c2 CTB
|
||||||
|
00000001 98 length
|
||||||
|
00000002 06 version
|
||||||
|
00000003 00 type
|
||||||
|
00000004 1b pk_algo
|
||||||
|
00000005 0a hash_algo
|
||||||
|
00000006 00 00 00 29 hashed_area_len
|
||||||
|
0000000a 05 subpacket length
|
||||||
|
0000000b 82 subpacket tag
|
||||||
|
0000000c 65 3d 2d 0f sig creation time
|
||||||
|
00000010 22 subpacket length
|
||||||
|
00000011 21 subpacket tag
|
||||||
|
00000012 06 version
|
||||||
|
00000013 d0 7b 24 ec 91 a1 4d d2 40 ac 2d 53 e6 issuer fp
|
||||||
|
00000020 c8 a9 e0 54 94 9a 41 22 2e a7 38 57 6e d1 9c ae
|
||||||
|
00000030 a3 dc 99
|
||||||
|
00000033 00 00 00 00 unhashed_area_len
|
||||||
|
00000037 db digest_prefix1
|
||||||
|
00000038 9e digest_prefix2
|
||||||
|
00000039 20 salt_len
|
||||||
|
0000003a 90 a4 54 9e 5a 0b salt
|
||||||
|
00000040 56 70 e3 ce 68 ed 8e f6 b8 73 e7 93 b9 2d 91 9c
|
||||||
|
00000050 a1 28 7d 8c b8 78 c2 74 81 d0
|
||||||
|
0000005a 53 4a 9e ff c6 d1 ed25519_sig
|
||||||
|
00000060 d0 1d f2 c0 73 73 2f 05 28 aa 3d 1e 7d 85 a1 8f
|
||||||
|
00000070 a5 de 5d ad 3c 85 ac 54 1f b8 b9 d0 c1 03 8d f1
|
||||||
|
00000080 6b 3d cd bc d4 1d 02 e5 f8 a2 18 de 0f 61 ce fa
|
||||||
|
00000090 07 cb 40 db f6 63 b1 28 07 0b
|
||||||
|
```
|
||||||
|
|
||||||
|
## Inline signature
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ sq sign --signer-file alice.pgp message.txt
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
xEYGAAobIK+vlFDAK62+055LpOCoOGecp66NiyRz6M+emCLp5Nbg0Hsk7JGhTdJA
|
||||||
|
rC1T5sip4FSUmkEiLqc4V27RnK6j3JkByxJiAAAAAABoZWxsbyB3b3JsZArCmAYA
|
||||||
|
GwoAAAApBYJlPXuNIiEG0Hsk7JGhTdJArC1T5sip4FSUmkEiLqc4V27RnK6j3JkA
|
||||||
|
AAAAhrggr6+UUMArrb7Tnkuk4Kg4Z5ynro2LJHPoz56YIunk1uApSiAe9CYGgqrs
|
||||||
|
p6Ud6ARDVcOWWFhxTJK2rNULlZ9k4HPFvUT4PTrjpb4kjRAb6MDgSSclPaj14FjL
|
||||||
|
rpr/eqQF
|
||||||
|
=r993
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
```
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ sq packet dump --hex inline-sig.txt
|
||||||
|
One-Pass Signature Packet, new CTB, 2 header bytes + 70 bytes
|
||||||
|
Version: 6
|
||||||
|
Type: Binary
|
||||||
|
Pk algo: Ed25519
|
||||||
|
Hash algo: SHA512
|
||||||
|
Issuer: D07B24EC91A14DD240AC2D53E6C8A9E054949A41222EA738576ED19CAEA3DC99
|
||||||
|
Last: true
|
||||||
|
|
||||||
|
00000000 c4 CTB
|
||||||
|
00000001 46 length
|
||||||
|
00000002 06 version
|
||||||
|
00000003 00 type
|
||||||
|
00000004 0a hash_algo
|
||||||
|
00000005 1b pk_algo
|
||||||
|
00000006 20 salt_len
|
||||||
|
00000007 af af 94 50 c0 2b ad be d3 salt
|
||||||
|
00000010 9e 4b a4 e0 a8 38 67 9c a7 ae 8d 8b 24 73 e8 cf
|
||||||
|
00000020 9e 98 22 e9 e4 d6 e0
|
||||||
|
00000027 d0 7b 24 ec 91 a1 4d d2 40 issuer
|
||||||
|
00000030 ac 2d 53 e6 c8 a9 e0 54 94 9a 41 22 2e a7 38 57
|
||||||
|
00000040 6e d1 9c ae a3 dc 99
|
||||||
|
00000047 01 last
|
||||||
|
|
||||||
|
Literal Data Packet, new CTB, 2 header bytes + 18 bytes
|
||||||
|
Format: Binary data
|
||||||
|
Content: "hello world\n"
|
||||||
|
|
||||||
|
00000000 cb CTB
|
||||||
|
00000001 12 length
|
||||||
|
00000002 62 format
|
||||||
|
00000003 00 filename_len
|
||||||
|
00000004 00 00 00 00 date
|
||||||
|
00000008 68 65 6c 6c 6f 20 77 6f hello wo
|
||||||
|
00000010 72 6c 64 0a rld.
|
||||||
|
|
||||||
|
Signature Packet, new CTB, 2 header bytes + 152 bytes
|
||||||
|
Version: 6
|
||||||
|
Type: Binary
|
||||||
|
Pk algo: Ed25519
|
||||||
|
Hash algo: SHA512
|
||||||
|
Hashed area:
|
||||||
|
Signature creation time: 2023-10-28 21:22:21 UTC (critical)
|
||||||
|
Issuer Fingerprint: D07B24EC91A14DD240AC2D53E6C8A9E054949A41222EA738576ED19CAEA3DC99
|
||||||
|
Digest prefix: 86B8
|
||||||
|
Level: 0 (signature over data)
|
||||||
|
|
||||||
|
00000000 c2 CTB
|
||||||
|
00000001 98 length
|
||||||
|
00000002 06 version
|
||||||
|
00000003 00 type
|
||||||
|
00000004 1b pk_algo
|
||||||
|
00000005 0a hash_algo
|
||||||
|
00000006 00 00 00 29 hashed_area_len
|
||||||
|
0000000a 05 subpacket length
|
||||||
|
0000000b 82 subpacket tag
|
||||||
|
0000000c 65 3d 7b 8d sig creation time
|
||||||
|
00000010 22 subpacket length
|
||||||
|
00000011 21 subpacket tag
|
||||||
|
00000012 06 version
|
||||||
|
00000013 d0 7b 24 ec 91 a1 4d d2 40 ac 2d 53 e6 issuer fp
|
||||||
|
00000020 c8 a9 e0 54 94 9a 41 22 2e a7 38 57 6e d1 9c ae
|
||||||
|
00000030 a3 dc 99
|
||||||
|
00000033 00 00 00 00 unhashed_area_len
|
||||||
|
00000037 86 digest_prefix1
|
||||||
|
00000038 b8 digest_prefix2
|
||||||
|
00000039 20 salt_len
|
||||||
|
0000003a af af 94 50 c0 2b salt
|
||||||
|
00000040 ad be d3 9e 4b a4 e0 a8 38 67 9c a7 ae 8d 8b 24
|
||||||
|
00000050 73 e8 cf 9e 98 22 e9 e4 d6 e0
|
||||||
|
0000005a 29 4a 20 1e f4 26 ed25519_sig
|
||||||
|
00000060 06 82 aa ec a7 a5 1d e8 04 43 55 c3 96 58 58 71
|
||||||
|
00000070 4c 92 b6 ac d5 0b 95 9f 64 e0 73 c5 bd 44 f8 3d
|
||||||
|
00000080 3a e3 a5 be 24 8d 10 1b e8 c0 e0 49 27 25 3d a8
|
||||||
|
00000090 f5 e0 58 cb ae 9a ff 7a a4 05
|
||||||
|
```
|
||||||
|
|
||||||
|
## Cleartext signature
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ sq sign --cleartext-signature --signer-file alice.pgp message.txt
|
||||||
|
-----BEGIN PGP SIGNED MESSAGE-----
|
||||||
|
Hash: SHA512
|
||||||
|
|
||||||
|
hello world
|
||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
wpgGARsKAAAAKQWCZT0vBCIhBtB7JOyRoU3SQKwtU+bIqeBUlJpBIi6nOFdu0Zyu
|
||||||
|
o9yZAAAAANqgIHAzoRTzu/7Zuxc8Izf4r3/qSCmBfDqWzTXqmVtsSBSHACka3qbN
|
||||||
|
eehqu8H6S0UK8V7yHbpVhExu9Hu72jWEzU/B0h9MR5gDhJPoWurx8YfyXBDsRS4y
|
||||||
|
r13/eqMN8kfCDw==
|
||||||
|
=Ks9w
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
|
```
|
||||||
|
|
||||||
|
```text
|
||||||
|
$ sq packet dump --hex cleartext-sig.txt
|
||||||
|
Signature Packet, new CTB, 2 header bytes + 152 bytes
|
||||||
|
Version: 6
|
||||||
|
Type: Text
|
||||||
|
Pk algo: Ed25519
|
||||||
|
Hash algo: SHA512
|
||||||
|
Hashed area:
|
||||||
|
Signature creation time: 2023-10-28 15:55:48 UTC (critical)
|
||||||
|
Issuer Fingerprint: D07B24EC91A14DD240AC2D53E6C8A9E054949A41222EA738576ED19CAEA3DC99
|
||||||
|
Digest prefix: DAA0
|
||||||
|
Level: 0 (signature over data)
|
||||||
|
|
||||||
|
00000000 c2 CTB
|
||||||
|
00000001 98 length
|
||||||
|
00000002 06 version
|
||||||
|
00000003 01 type
|
||||||
|
00000004 1b pk_algo
|
||||||
|
00000005 0a hash_algo
|
||||||
|
00000006 00 00 00 29 hashed_area_len
|
||||||
|
0000000a 05 subpacket length
|
||||||
|
0000000b 82 subpacket tag
|
||||||
|
0000000c 65 3d 2f 04 sig creation time
|
||||||
|
00000010 22 subpacket length
|
||||||
|
00000011 21 subpacket tag
|
||||||
|
00000012 06 version
|
||||||
|
00000013 d0 7b 24 ec 91 a1 4d d2 40 ac 2d 53 e6 issuer fp
|
||||||
|
00000020 c8 a9 e0 54 94 9a 41 22 2e a7 38 57 6e d1 9c ae
|
||||||
|
00000030 a3 dc 99
|
||||||
|
00000033 00 00 00 00 unhashed_area_len
|
||||||
|
00000037 da digest_prefix1
|
||||||
|
00000038 a0 digest_prefix2
|
||||||
|
00000039 20 salt_len
|
||||||
|
0000003a 70 33 a1 14 f3 bb salt
|
||||||
|
00000040 fe d9 bb 17 3c 23 37 f8 af 7f ea 48 29 81 7c 3a
|
||||||
|
00000050 96 cd 35 ea 99 5b 6c 48 14 87
|
||||||
|
0000005a 00 29 1a de a6 cd ed25519_sig
|
||||||
|
00000060 79 e8 6a bb c1 fa 4b 45 0a f1 5e f2 1d ba 55 84
|
||||||
|
00000070 4c 6e f4 7b bb da 35 84 cd 4f c1 d2 1f 4c 47 98
|
||||||
|
00000080 03 84 93 e8 5a ea f1 f1 87 f2 5c 10 ec 45 2e 32
|
||||||
|
00000090 af 5d ff 7a a3 0d f2 47 c2 0f
|
||||||
|
```
|
||||||
|
|
|
||||||
BIN
book/source/diag/subkey_binding_signatur_for_signing_sk.png
Normal file
BIN
book/source/diag/subkey_binding_signatur_for_signing_sk.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 154 KiB |
BIN
book/source/diag/subkey_binding_signature.png
Normal file
BIN
book/source/diag/subkey_binding_signature.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 122 KiB |
871
book/source/diag/subkey_binding_signature.svg
Normal file
871
book/source/diag/subkey_binding_signature.svg
Normal file
|
|
@ -0,0 +1,871 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
||||||
|
<svg
|
||||||
|
viewBox="0 0 667.72943 687.72498"
|
||||||
|
version="1.1"
|
||||||
|
id="svg1"
|
||||||
|
sodipodi:docname="diag_library_draft.svg"
|
||||||
|
inkscape:version="1.3 (0e150ed6c4, 2023-07-21)"
|
||||||
|
width="667.72943"
|
||||||
|
height="687.72498"
|
||||||
|
xml:space="preserve"
|
||||||
|
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
|
||||||
|
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
|
||||||
|
xmlns="http://www.w3.org/2000/svg"
|
||||||
|
xmlns:svg="http://www.w3.org/2000/svg"><defs
|
||||||
|
id="defs1"><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect76"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><marker
|
||||||
|
style="overflow:visible"
|
||||||
|
id="marker72"
|
||||||
|
refX="0"
|
||||||
|
refY="0"
|
||||||
|
orient="auto"
|
||||||
|
inkscape:stockid="Square"
|
||||||
|
markerWidth="1"
|
||||||
|
markerHeight="1"
|
||||||
|
viewBox="0 0 1 1"
|
||||||
|
inkscape:isstock="true"
|
||||||
|
inkscape:collect="always"
|
||||||
|
preserveAspectRatio="xMidYMid"><path
|
||||||
|
transform="scale(0.5)"
|
||||||
|
style="fill:context-stroke;fill-rule:evenodd;stroke:none"
|
||||||
|
d="M -5,-5 V 5 H 5 V -5 Z"
|
||||||
|
id="path72" /></marker><marker
|
||||||
|
style="overflow:visible"
|
||||||
|
id="Square"
|
||||||
|
refX="0"
|
||||||
|
refY="0"
|
||||||
|
orient="auto"
|
||||||
|
inkscape:stockid="Square"
|
||||||
|
markerWidth="1"
|
||||||
|
markerHeight="1"
|
||||||
|
viewBox="0 0 1 1"
|
||||||
|
inkscape:isstock="true"
|
||||||
|
inkscape:collect="always"
|
||||||
|
preserveAspectRatio="xMidYMid"><path
|
||||||
|
transform="scale(0.5)"
|
||||||
|
style="fill:context-stroke;fill-rule:evenodd;stroke:none"
|
||||||
|
d="M -5,-5 V 5 H 5 V -5 Z"
|
||||||
|
id="path18" /></marker><linearGradient
|
||||||
|
id="swatch251"
|
||||||
|
inkscape:swatch="solid"><stop
|
||||||
|
style="stop-color:#195962;stop-opacity:1;"
|
||||||
|
offset="0"
|
||||||
|
id="stop251" /></linearGradient><filter
|
||||||
|
style="color-interpolation-filters:sRGB"
|
||||||
|
inkscape:label="Drop Shadow"
|
||||||
|
id="filter90-4"
|
||||||
|
x="-0.019535193"
|
||||||
|
y="-0.028762213"
|
||||||
|
width="1.0422425"
|
||||||
|
height="1.0655139"><feFlood
|
||||||
|
result="flood"
|
||||||
|
in="SourceGraphic"
|
||||||
|
flood-opacity="0.796078"
|
||||||
|
flood-color="rgb(62,67,73)"
|
||||||
|
id="feFlood89-4" /><feGaussianBlur
|
||||||
|
result="blur"
|
||||||
|
in="SourceGraphic"
|
||||||
|
stdDeviation="2.132 0"
|
||||||
|
id="feGaussianBlur89-4" /><feOffset
|
||||||
|
result="offset"
|
||||||
|
in="blur"
|
||||||
|
dx="1.000000"
|
||||||
|
dy="1.000000"
|
||||||
|
id="feOffset89-4" /><feComposite
|
||||||
|
result="comp1"
|
||||||
|
operator="in"
|
||||||
|
in="flood"
|
||||||
|
in2="offset"
|
||||||
|
id="feComposite89-7" /><feComposite
|
||||||
|
result="fbSourceGraphic"
|
||||||
|
operator="over"
|
||||||
|
in="SourceGraphic"
|
||||||
|
in2="comp1"
|
||||||
|
id="feComposite90-6" /><feColorMatrix
|
||||||
|
result="fbSourceGraphicAlpha"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
values="0 0 0 -1 0 0 0 0 -1 0 0 0 0 -1 0 0 0 0 1 0"
|
||||||
|
id="feColorMatrix90-3" /><feFlood
|
||||||
|
id="feFlood90-1"
|
||||||
|
result="flood"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
flood-opacity="0.796078"
|
||||||
|
flood-color="rgb(62,67,73)" /><feGaussianBlur
|
||||||
|
id="feGaussianBlur90-7"
|
||||||
|
result="blur"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
stdDeviation="3.000000" /><feOffset
|
||||||
|
id="feOffset90-5"
|
||||||
|
result="offset"
|
||||||
|
in="blur"
|
||||||
|
dx="1.000000"
|
||||||
|
dy="1.000000" /><feComposite
|
||||||
|
id="feComposite91-9"
|
||||||
|
result="comp1"
|
||||||
|
operator="in"
|
||||||
|
in="flood"
|
||||||
|
in2="offset" /><feComposite
|
||||||
|
id="feComposite92-62"
|
||||||
|
result="comp2"
|
||||||
|
operator="over"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
in2="comp1" /></filter><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect35-9-8"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect32-0-3-1-7-4"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 | F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 | F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect71-63-8"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,12.362879,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect35-1"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect32-0-3-1-7-0-6"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 | F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 | F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect71-63-4-8"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,12.362879,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><marker
|
||||||
|
style="overflow:visible"
|
||||||
|
id="Triangle-7"
|
||||||
|
refX="0"
|
||||||
|
refY="0"
|
||||||
|
orient="auto-start-reverse"
|
||||||
|
inkscape:stockid="Triangle arrow"
|
||||||
|
markerWidth="1"
|
||||||
|
markerHeight="1"
|
||||||
|
viewBox="0 0 1 1"
|
||||||
|
inkscape:isstock="true"
|
||||||
|
inkscape:collect="always"
|
||||||
|
preserveAspectRatio="xMidYMid"><path
|
||||||
|
transform="scale(0.5)"
|
||||||
|
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
|
||||||
|
d="M 5.77,0 -2.88,5 V -5 Z"
|
||||||
|
id="path135-4" /></marker><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect69-1"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect73-5-6-1"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,8.3767486,0,1 @ F,0,0,1,0,4.9328368,0,1 @ F,0,0,1,0,8.3767486,0,1 @ F,0,0,1,0,9.8529047,0,1 @ F,0,0,1,0,9.8529047,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect40-5-3"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,1.4241302,0,1 @ F,0,0,1,0,1.5938702,0,1 @ F,0,0,1,0,2.0791429,0,1 | F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 | F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,1.6242618,0,1 @ F,0,0,1,0,1.0943551,0,1 @ F,0,0,1,0,1.6855157,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1 @ F,0,0,1,0,2.0791429,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect71-63-4-8-9"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,14.172281,0,1 @ F,0,0,1,0,7.4171831,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect71-63-4-8-9-9"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><marker
|
||||||
|
style="overflow:visible"
|
||||||
|
id="Triangle-3"
|
||||||
|
refX="0"
|
||||||
|
refY="0"
|
||||||
|
orient="auto-start-reverse"
|
||||||
|
inkscape:stockid="Triangle arrow"
|
||||||
|
markerWidth="1"
|
||||||
|
markerHeight="1"
|
||||||
|
viewBox="0 0 1 1"
|
||||||
|
inkscape:isstock="true"
|
||||||
|
inkscape:collect="always"
|
||||||
|
preserveAspectRatio="xMidYMid"><path
|
||||||
|
transform="scale(0.5)"
|
||||||
|
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
|
||||||
|
d="M 5.77,0 -2.88,5 V -5 Z"
|
||||||
|
id="path135-3" /></marker><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect69-6"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,11.212676,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /></defs><sodipodi:namedview
|
||||||
|
id="namedview1"
|
||||||
|
pagecolor="#ffffff"
|
||||||
|
bordercolor="#000000"
|
||||||
|
borderopacity="0.25"
|
||||||
|
inkscape:showpageshadow="2"
|
||||||
|
inkscape:pageopacity="0.0"
|
||||||
|
inkscape:pagecheckerboard="0"
|
||||||
|
inkscape:deskcolor="#d1d1d1"
|
||||||
|
inkscape:lockguides="false"
|
||||||
|
inkscape:zoom="0.77037638"
|
||||||
|
inkscape:cx="2217.0981"
|
||||||
|
inkscape:cy="1738.7605"
|
||||||
|
inkscape:window-width="2560"
|
||||||
|
inkscape:window-height="1371"
|
||||||
|
inkscape:window-x="0"
|
||||||
|
inkscape:window-y="305"
|
||||||
|
inkscape:window-maximized="1"
|
||||||
|
inkscape:current-layer="g67-9"
|
||||||
|
showgrid="false"
|
||||||
|
inkscape:export-bgcolor="#ffffff00"
|
||||||
|
showguides="false"><inkscape:page
|
||||||
|
x="3.9659067e-06"
|
||||||
|
y="5.1035599e-06"
|
||||||
|
width="667.72943"
|
||||||
|
height="687.72498"
|
||||||
|
id="page72"
|
||||||
|
margin="0"
|
||||||
|
bleed="0"
|
||||||
|
inkscape:export-filename="subkey_binding_signature.png"
|
||||||
|
inkscape:export-xdpi="94.510002"
|
||||||
|
inkscape:export-ydpi="94.510002" /></sodipodi:namedview><!--! Font Awesome Pro 6.4.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license (Commercial License) Copyright 2023 Fonticons, Inc. --><g
|
||||||
|
inkscape:groupmode="layer"
|
||||||
|
id="layer5"
|
||||||
|
inkscape:label="Chapter 4"
|
||||||
|
inkscape:highlight-color="#baa600"
|
||||||
|
transform="translate(-1527.7301,-1276.1634)"><g
|
||||||
|
inkscape:groupmode="layer"
|
||||||
|
id="layer7"
|
||||||
|
inkscape:label="Component Key"
|
||||||
|
transform="translate(11.236271,-4.7700578)"
|
||||||
|
style="display:inline"><g
|
||||||
|
id="g67"
|
||||||
|
transform="translate(133.11528,614.48564)"
|
||||||
|
style="display:inline;stroke-width:1.7;stroke-dasharray:none"><rect
|
||||||
|
style="fill:#baa600;fill-opacity:0.25;stroke:#baa600;stroke-width:1.4;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:2.8, 2.8;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
id="rect66"
|
||||||
|
width="378.45499"
|
||||||
|
height="52.826336"
|
||||||
|
x="855.52289"
|
||||||
|
y="454.69138" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:21.3333px;line-height:17.9px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;white-space:pre;inline-size:393.624;display:inline;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:1.7786;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="562.8764"
|
||||||
|
y="408.97891"
|
||||||
|
id="text11-3-4-3"
|
||||||
|
transform="matrix(0.95580583,0,0,0.95580583,326.86618,86.500043)"
|
||||||
|
inkscape:label="fingerprint sk encr"><tspan
|
||||||
|
x="562.8764"
|
||||||
|
y="408.97891"
|
||||||
|
id="tspan3"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan1">C0A5 8384 A438 E5A1 4F73 7124 26A4 D45D</tspan> </tspan><tspan
|
||||||
|
x="562.8764"
|
||||||
|
y="428.39824"
|
||||||
|
id="tspan5"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan4">BAEE F4A3 9E6B 30B0 9D55 13F9 78AC CA94</tspan></tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:18.6667px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="740.55432"
|
||||||
|
y="476.66418"
|
||||||
|
id="text11-2-8-02-9"
|
||||||
|
transform="scale(0.98944431,1.0106683)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-7-1"
|
||||||
|
x="740.55432"
|
||||||
|
y="476.66418"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:18.6667px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start;stroke-width:1.7;stroke-dasharray:none">Fingerprint</tspan></text><path
|
||||||
|
style="opacity:1;fill:none;fill-opacity:1;stroke:#baa600;stroke-width:1.4;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:2.8, 2.8;stroke-dashoffset:0;stroke-opacity:1;marker-start:url(#Square);paint-order:fill markers stroke"
|
||||||
|
d="m 853.59098,505.62944 -78.85694,0.0298 -0.27607,-16.40163"
|
||||||
|
id="path252"
|
||||||
|
sodipodi:nodetypes="ccc" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:12px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;white-space:pre;inline-size:207.42;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="1840.4709"
|
||||||
|
y="784.19983"
|
||||||
|
id="text11-2-8-02-9-0"
|
||||||
|
transform="matrix(0.98944431,0,0,1.0106683,-55.990406,36.612296)"><tspan
|
||||||
|
x="1840.4709"
|
||||||
|
y="784.19983"
|
||||||
|
id="tspan9"><tspan
|
||||||
|
style="font-weight:500;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium'"
|
||||||
|
id="tspan6">Primary key creates a "subkey </tspan></tspan><tspan
|
||||||
|
x="1840.4709"
|
||||||
|
y="799.31043"
|
||||||
|
id="tspan11"><tspan
|
||||||
|
style="font-weight:500;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium'"
|
||||||
|
id="tspan10">binding signature" to bind the </tspan></tspan><tspan
|
||||||
|
x="1840.4709"
|
||||||
|
y="814.42103"
|
||||||
|
id="tspan13"><tspan
|
||||||
|
style="font-weight:500;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium'"
|
||||||
|
id="tspan12">subkey to the primary key</tspan></tspan></text></g></g><g
|
||||||
|
inkscape:groupmode="layer"
|
||||||
|
id="layer12"
|
||||||
|
inkscape:label="Binding Signature"
|
||||||
|
style="display:inline"><g
|
||||||
|
id="g76"
|
||||||
|
transform="translate(12.431469)"><path
|
||||||
|
style="display:inline;opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:1.59;stroke-linecap:round;stroke-miterlimit:0;stroke-dasharray:4.95, 4.95;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke;filter:url(#filter90-4)"
|
||||||
|
id="rect76"
|
||||||
|
width="630.49286"
|
||||||
|
height="609.91095"
|
||||||
|
x="1545.3427"
|
||||||
|
y="1370.053"
|
||||||
|
inkscape:path-effect="#path-effect76"
|
||||||
|
sodipodi:type="rect"
|
||||||
|
d="m 1583.4442,1370.053 h 554.2898 c 21.1082,0 38.1015,16.9933 38.1015,38.1015 v 533.7079 c 0,21.1082 -16.9933,38.1015 -38.1015,38.1015 h -554.2898 c -21.1083,0 -38.1015,-16.9933 -38.1015,-38.1015 v -533.7079 c 0,-21.1082 16.9932,-38.1015 38.1015,-38.1015 z"
|
||||||
|
ry="38.101555"
|
||||||
|
rx="38.101555"
|
||||||
|
transform="translate(-12.431469,-32)"
|
||||||
|
sodipodi:insensitive="true" /><g
|
||||||
|
id="g11-8-3-1"
|
||||||
|
transform="matrix(0.86376245,0,0,0.86376245,818.09698,1171.122)"
|
||||||
|
inkscape:label="Diagramm Header"
|
||||||
|
style="display:inline;opacity:1;fill:#61a78d;fill-opacity:1"
|
||||||
|
sodipodi:insensitive="true"><rect
|
||||||
|
style="font-variation-settings:'wght' 700;fill:#195962;stroke-width:2.56081;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
id="rect1-9-8-2"
|
||||||
|
width="341.93723"
|
||||||
|
height="59.990269"
|
||||||
|
x="920.04065"
|
||||||
|
y="155.65892" /><g
|
||||||
|
id="g4-7-0-4"
|
||||||
|
transform="translate(-11.145477,39.927363)"><rect
|
||||||
|
style="font-variation-settings:'wght' 700;fill:#e6e6e6;fill-opacity:1;stroke-width:2.52183;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
id="rect1-3-7-5-7"
|
||||||
|
width="343.65778"
|
||||||
|
height="57.886284"
|
||||||
|
x="920.89868"
|
||||||
|
y="126.45267" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:600;font-stretch:normal;font-size:27.967px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Semi-Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;white-space:pre;inline-size:383.857;display:inline;fill:#3e4349;fill-opacity:1;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
x="954.24536"
|
||||||
|
y="158.38867"
|
||||||
|
id="text1-6-6-8"
|
||||||
|
transform="matrix(0.85813569,0,0,0.85813569,117.0538,26.328688)"><tspan
|
||||||
|
x="954.24536"
|
||||||
|
y="158.38867"
|
||||||
|
id="tspan14">Subkey binding signature</tspan></text></g></g><g
|
||||||
|
id="g41-1"
|
||||||
|
style="display:inline"
|
||||||
|
inkscape:label="Subkey encr"
|
||||||
|
transform="matrix(0.8263553,0,0,0.8263553,855.96046,1522.7174)"><path
|
||||||
|
id="rect11-2-9"
|
||||||
|
d="m 884.2432,192.95468 h 359.0109 a 18.14255,18.14255 45 0 1 18.1425,18.14255 v 126.63435 a 18.14255,18.14255 135 0 1 -18.1425,18.14255 H 884.2432 A 18.14255,18.14255 45 0 1 866.10065,337.73158 V 211.09723 a 18.14255,18.14255 135 0 1 18.14255,-18.14255 z"
|
||||||
|
style="font-variation-settings:'wght' 500;fill:none;fill-opacity:0.1;stroke:#195962;stroke-width:4.39384;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
inkscape:path-effect="#path-effect35-9-8"
|
||||||
|
inkscape:original-d="M 866.10065,192.95468 H 1261.3966 V 355.87413 H 866.10065 Z"
|
||||||
|
transform="matrix(0.92016709,0,0,0.69628804,56.855601,194.47989)" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:21.3333px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="870.22443"
|
||||||
|
y="359.37485"
|
||||||
|
id="text11-2-8-96"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-0"
|
||||||
|
x="870.22443"
|
||||||
|
y="359.37485"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:21.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start">Component Key</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:16px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="338.83902"
|
||||||
|
y="-1225.12"
|
||||||
|
id="text11-2-8-0-6"
|
||||||
|
transform="rotate(90)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-2-49"
|
||||||
|
x="338.83902"
|
||||||
|
y="-1225.12"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:16px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Bold';text-align:start;text-anchor:start">encryption</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:21.3333px;line-height:17.9px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;white-space:pre;inline-size:393.624;display:inline;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="562.8764"
|
||||||
|
y="408.97891"
|
||||||
|
id="text11-3-4-90"
|
||||||
|
transform="matrix(0.95580583,0,0,0.95580583,329.05744,76.348676)"
|
||||||
|
inkscape:label="fingerprint sk encr"><tspan
|
||||||
|
x="562.8764"
|
||||||
|
y="408.97891"
|
||||||
|
id="tspan16"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan15">C0A5 8384 A438 E5A1 4F73 7124 26A4 D45D</tspan> </tspan><tspan
|
||||||
|
x="562.8764"
|
||||||
|
y="428.39824"
|
||||||
|
id="tspan18"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan17">BAEE F4A3 9E6B 30B0 9D55 13F9 78AC CA94</tspan></tspan></text><path
|
||||||
|
id="path2-3-2-5-4"
|
||||||
|
style="display:inline;fill:none;stroke:#006961;stroke-width:12.5773;stroke-linecap:round;stroke-dasharray:none;stroke-opacity:1"
|
||||||
|
d="m 156.30312,759.25868 c -9.78054,19.91382 -30.12868,33.02384 -53.81237,33.02384 -33.173715,0 -60.066326,-26.89261 -60.066326,-60.06633 0,-33.17372 26.892611,-60.06633 60.066326,-60.06633 23.31181,0 43.58824,15.15712 53.54415,34.5646 m -9.14624,1.20213 h 4.97796 c 10.89491,0.20296 25.86265,0 38.79397,0 l 11.43353,7.63836 14.59897,-7.63836 14.59896,7.3422 h 10.87817 l 11.54761,-7.3422 17.66083,7.3422 16.34856,-7.34219 22,25.45886 -22,25.45887 h -135.8606 -4.97796 M 89.058073,732.21619 c -4e-6,6.98969 -5.666271,12.65596 -12.655965,12.65596 -6.989695,0 -12.655963,-5.66627 -12.655967,-12.65596 -2e-6,-6.9897 5.666268,-12.65597 12.655967,-12.65597 6.989698,0 12.655967,5.66627 12.655965,12.65597 z"
|
||||||
|
inkscape:label="Publickey ((Asym))"
|
||||||
|
sodipodi:nodetypes="cssscccccccccccccccsssss"
|
||||||
|
transform="matrix(0.30474777,0,0,-0.30432596,1091.2486,632.13837)"
|
||||||
|
inkscape:path-effect="#path-effect32-0-3-1-7-4"
|
||||||
|
inkscape:original-d="m 156.30312,759.25868 c -9.78054,19.91382 -30.12868,33.02384 -53.81237,33.02384 -33.173715,0 -60.066326,-26.89261 -60.066326,-60.06633 0,-33.17372 26.892611,-60.06633 60.066326,-60.06633 23.31181,0 43.58824,15.15712 53.54415,34.5646 m -9.14624,1.20213 h 4.97796 c 10.89491,0.20296 25.86265,0 38.79397,0 l 11.43353,7.63836 14.59897,-7.63836 14.59896,7.3422 h 10.87817 l 11.54761,-7.3422 17.66083,7.3422 16.34856,-7.34219 22,25.45886 -22,25.45887 h -135.8606 -4.97796 M 89.058073,732.21619 c -4e-6,6.98969 -5.666271,12.65596 -12.655965,12.65596 -6.989695,0 -12.655963,-5.66627 -12.655967,-12.65596 -2e-6,-6.9897 5.666268,-12.65597 12.655967,-12.65597 6.989698,0 12.655967,5.66627 12.655965,12.65597 z" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:20.5595px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:4.06237;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="872.33105"
|
||||||
|
y="416.93719"
|
||||||
|
id="text11-9-0-8"
|
||||||
|
transform="scale(1.0006928,0.99930768)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-3-6-9"
|
||||||
|
x="872.33105"
|
||||||
|
y="416.93719"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:20.5595px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start;stroke-width:4.06237">- key creation time</tspan></text><path
|
||||||
|
style="display:inline;fill:none;fill-opacity:1;stroke:#195962;stroke-width:2.48502;stroke-linecap:square;stroke-dasharray:4.97003, 4.97003;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
d="m 850.55372,198.75048 223.49328,0 a 12.362879,12.362879 45 0 1 12.3629,12.36288 v 49.53492"
|
||||||
|
id="path71-5-6"
|
||||||
|
sodipodi:nodetypes="ccc"
|
||||||
|
inkscape:path-effect="#path-effect71-63-8"
|
||||||
|
inkscape:original-d="m 850.55372,198.75048 h 235.85618 v 61.8978"
|
||||||
|
transform="matrix(0.96439285,0,0,0.96305804,36.49511,189.52526)" /></g><g
|
||||||
|
id="g40-7"
|
||||||
|
style="display:inline"
|
||||||
|
inkscape:label="Primary"
|
||||||
|
transform="matrix(0.8201545,0,0,0.8201545,866.66451,1317.6808)"><path
|
||||||
|
id="rect11-7"
|
||||||
|
d="m 884.2432,192.95468 h 359.0109 a 18.14255,18.14255 45 0 1 18.1425,18.14255 v 126.63435 a 18.14255,18.14255 135 0 1 -18.1425,18.14255 H 884.2432 A 18.14255,18.14255 45 0 1 866.10065,337.73158 V 211.09723 a 18.14255,18.14255 135 0 1 18.14255,-18.14255 z"
|
||||||
|
style="font-variation-settings:'wght' 500;fill:#195962;fill-opacity:0.1;stroke:#195962;stroke-width:4.39384;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
inkscape:path-effect="#path-effect35-1"
|
||||||
|
inkscape:original-d="M 866.10065,192.95468 H 1261.3966 V 355.87413 H 866.10065 Z"
|
||||||
|
transform="matrix(0.92016709,0,0,0.69628804,50.430978,-3.7263769)" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:21.3333px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="861.96753"
|
||||||
|
y="161.23524"
|
||||||
|
id="text11-2-3"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-7"
|
||||||
|
x="861.96753"
|
||||||
|
y="161.23524"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:21.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start">Component Key (primary)</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:21.3333px;line-height:17.9px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;white-space:pre;inline-size:393.624;display:inline;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="559.75104"
|
||||||
|
y="408.97891"
|
||||||
|
id="text11-3-1"
|
||||||
|
transform="matrix(0.95580583,0,0,0.95580583,312.44807,-124.51895)"
|
||||||
|
inkscape:label="fingerprint primary"><tspan
|
||||||
|
x="559.75104"
|
||||||
|
y="408.97891"
|
||||||
|
id="tspan20"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan19">AAA1 8CBB 2546 85C5 8358 3205 63FD 37B6</tspan> </tspan><tspan
|
||||||
|
x="559.75104"
|
||||||
|
y="428.39824"
|
||||||
|
id="tspan22"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan21">7F33 00F9 FB0E C457 378C D29F 1026 98B3</tspan></tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:16px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;display:inline;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="149.70236"
|
||||||
|
y="-1324.163"
|
||||||
|
id="text11-2-8-0-4-1"
|
||||||
|
transform="rotate(90,-46.430008,-58.327962)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-2-76-50"
|
||||||
|
x="149.70236"
|
||||||
|
y="-1324.163"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:16px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Bold';text-align:start;text-anchor:start">certification</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:18.7631px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;display:inline;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.70741;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="965.3064"
|
||||||
|
y="226.99016"
|
||||||
|
id="text11-9-0-0-9"
|
||||||
|
transform="matrix(1.0578135,0,0,1.0563493,-151.50452,-19.946044)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-3-6-3-0"
|
||||||
|
x="965.3064"
|
||||||
|
y="226.99016"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:18.7631px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start;stroke-width:3.70741">- key creation time</tspan></text><path
|
||||||
|
id="path2-3-2-5-8-4"
|
||||||
|
style="display:inline;opacity:1;fill:none;stroke:#006961;stroke-width:12.5773;stroke-linecap:round;stroke-dasharray:none;stroke-opacity:1"
|
||||||
|
d="m 156.30312,759.25868 c -9.78054,19.91382 -30.12868,33.02384 -53.81237,33.02384 -33.173715,0 -60.066326,-26.89261 -60.066326,-60.06633 0,-33.17372 26.892611,-60.06633 60.066326,-60.06633 23.31181,0 43.58824,15.15712 53.54415,34.5646 m -9.14624,1.20213 h 4.97796 c 10.89491,0.20296 25.86265,0 38.79397,0 l 11.43353,7.63836 14.59897,-7.63836 14.59896,7.3422 h 10.87817 l 11.54761,-7.3422 17.66083,7.3422 16.34856,-7.34219 22,25.45886 -22,25.45887 h -135.8606 -4.97796 M 89.058073,732.21619 c -4e-6,6.98969 -5.666271,12.65596 -12.655965,12.65596 -6.989695,0 -12.655963,-5.66627 -12.655967,-12.65596 -2e-6,-6.9897 5.666268,-12.65597 12.655967,-12.65597 6.989698,0 12.655967,5.66627 12.655965,12.65597 z"
|
||||||
|
inkscape:label="Publickey ((Asym))"
|
||||||
|
sodipodi:nodetypes="cssscccccccccccccccsssss"
|
||||||
|
transform="matrix(0.29399503,0,0,-0.29358811,1080.2197,427.72131)"
|
||||||
|
inkscape:path-effect="#path-effect32-0-3-1-7-0-6"
|
||||||
|
inkscape:original-d="m 156.30312,759.25868 c -9.78054,19.91382 -30.12868,33.02384 -53.81237,33.02384 -33.173715,0 -60.066326,-26.89261 -60.066326,-60.06633 0,-33.17372 26.892611,-60.06633 60.066326,-60.06633 23.31181,0 43.58824,15.15712 53.54415,34.5646 m -9.14624,1.20213 h 4.97796 c 10.89491,0.20296 25.86265,0 38.79397,0 l 11.43353,7.63836 14.59897,-7.63836 14.59896,7.3422 h 10.87817 l 11.54761,-7.3422 17.66083,7.3422 16.34856,-7.34219 22,25.45886 -22,25.45887 h -135.8606 -4.97796 M 89.058073,732.21619 c -4e-6,6.98969 -5.666271,12.65596 -12.655965,12.65596 -6.989695,0 -12.655963,-5.66627 -12.655967,-12.65596 -2e-6,-6.9897 5.666268,-12.65597 12.655967,-12.65597 6.989698,0 12.655967,5.66627 12.655965,12.65597 z" /><path
|
||||||
|
style="display:inline;opacity:1;fill:none;fill-opacity:1;stroke:#195962;stroke-width:2.48502;stroke-linecap:square;stroke-dasharray:4.97003, 4.97003;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
d="m 850.55372,198.75048 223.49328,0 a 12.362879,12.362879 45 0 1 12.3629,12.36288 v 49.53492"
|
||||||
|
id="path71-5-7-0"
|
||||||
|
sodipodi:nodetypes="ccc"
|
||||||
|
inkscape:path-effect="#path-effect71-63-4-8"
|
||||||
|
inkscape:original-d="m 850.55372,198.75048 h 235.85618 v 61.8978"
|
||||||
|
transform="matrix(0.93036515,0,0,0.92907745,62.682252,0.72538386)" /></g><g
|
||||||
|
id="g72"
|
||||||
|
inkscape:label="Arrow with signature"
|
||||||
|
transform="translate(-64.038255,9.5376028)"><path
|
||||||
|
style="fill:none;stroke:#195a63;stroke-width:2.475;stroke-linecap:round;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#Triangle-7);paint-order:fill markers stroke"
|
||||||
|
d="m 1025.9063,1407.1985 v 207.9552"
|
||||||
|
id="path48-2"
|
||||||
|
transform="translate(719.79302,147.8069)"
|
||||||
|
sodipodi:nodetypes="cc"
|
||||||
|
inkscape:path-effect="#path-effect69-1"
|
||||||
|
inkscape:original-d="m 1025.9063,1407.1985 v 207.9552" /><g
|
||||||
|
id="g73-1-3-1"
|
||||||
|
transform="matrix(-0.00633409,0.30302068,-0.30302068,-0.00633409,2155.5656,1458.9643)"
|
||||||
|
inkscape:label="Signature Tag"
|
||||||
|
style="display:inline"><path
|
||||||
|
id="rect72-4-3-7"
|
||||||
|
d="m 465.54003,1054.3166 25.38484,-19.1223 a 6.2319955,6.2319955 1.372191 0 1 7.73342,0.1853 l 22.40305,18.6225 a 17.856072,17.856072 64.867503 0 1 6.4418,13.7314 v 58.4004 a 9.8529047,9.8529047 135 0 1 -9.8529,9.8529 h -48.9481 a 9.8529047,9.8529047 45 0 1 -9.8529,-9.8529 v -58.4004 a 16.797717,16.797717 116.50469 0 1 6.69079,-13.4169 z"
|
||||||
|
style="fill:#ffffff;fill-opacity:1;stroke:#baa600;stroke-width:10;stroke-linecap:square;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
sodipodi:nodetypes="cccccc"
|
||||||
|
inkscape:path-effect="#path-effect73-5-6-1"
|
||||||
|
inkscape:original-d="m 458.84924,1059.3568 36.01565,-27.1305 32.63825,27.1305 v 76.63 h -68.6539 z"
|
||||||
|
transform="matrix(-1.2002561,-0.65991491,0.65991491,-1.2002561,470.62705,2920.2311)" /><g
|
||||||
|
id="g43-3-5"
|
||||||
|
transform="matrix(1.7674626,-2.5751833,2.9276239,1.5707383,-3390.777,793.56089)"><path
|
||||||
|
d="m 353.7667,1003.8464 a 2.3345405,2.3345405 43.17555 0 0 1.95452,1.8339 l 5.27096,1.912 a 1.4575089,1.4575089 144.969 0 0 1.95452,-1.3701 2.212012,2.212012 40.097717 0 0 -1.96653,-1.6559 l -2.14048,-0.7347 a 0.48881037,0.48881037 90 0 1 0,-0.9246 l 2.59947,-0.8923 a 2.2322145,2.2322145 125.52801 0 0 1.50754,-2.11127 1.2798843,1.2798843 21.174753 0 0 -1.95453,-0.75712 l -5.27094,1.91199 a 2.9659006,2.9659006 125.03106 0 0 -1.95453,2.7881 z m 14.67767,5.6607 4.5652,-13.03156 a 1.4746685,1.4746685 54.653161 0 0 -1.39174,-1.96222 2.5531352,2.5531352 138.37627 0 0 -2.20826,1.96222 l -4.5652,13.03156 a 1.4746685,1.4746685 54.653161 0 0 1.39174,1.9622 2.5531352,2.5531352 138.37627 0 0 2.20826,-1.9622 z m 9.04886,-7.3352 1.95118,0.6697 a 0.5575024,0.5575024 90 0 1 0,1.0546 l -2.88263,0.9894 a 1.5326438,1.5326438 125.52801 0 0 -1.03508,1.4497 v 0.2801 a 1.1815706,1.1815706 35.031004 0 0 1.58449,1.1107 l 5.64099,-2.0462 a 2.9659066,2.9659066 125.031 0 0 1.95452,-2.7881 2.3345359,2.3345359 43.175472 0 0 -1.95453,-1.8339 l -5.27094,-1.91199 a 1.4575118,1.4575118 144.96894 0 0 -1.95453,1.37019 2.2120009,2.2120009 40.097376 0 0 1.96653,1.6558 z"
|
||||||
|
id="text2-8-6"
|
||||||
|
style="font-weight:900;font-size:18px;line-height:21.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Heavy';letter-spacing:3.34px;white-space:pre;fill:#baa600;stroke-width:10;stroke-linecap:square;paint-order:fill markers stroke"
|
||||||
|
transform="translate(97.909825,78.103264)"
|
||||||
|
aria-label="</>"
|
||||||
|
inkscape:path-effect="#path-effect40-5-3"
|
||||||
|
inkscape:original-d="m 353.7667,1001.7673 v 3.204 l 9.18,3.33 v -3.06 l -5.454,-1.872 5.454,-1.872 v -3.05998 z m 13.99027,9.702 5.94,-16.95598 h -3.6 l -5.94,16.95598 z m 7.76973,-9.9724 5.454,1.872 -5.454,1.872 v 3.06 l 9.18,-3.33 v -3.204 l -9.18,-3.32998 z"
|
||||||
|
sodipodi:nodetypes="ccccccccccccccccccccc" /></g><g
|
||||||
|
id="g10-8-5-5-5"
|
||||||
|
transform="matrix(0.84435044,-0.66732317,0.66732317,0.84435044,-157.786,662.83605)"
|
||||||
|
inkscape:label="Signature vers2"><circle
|
||||||
|
style="fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:14.841;stroke-linecap:square;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
id="path73-4-1-4"
|
||||||
|
cx="228.22922"
|
||||||
|
cy="841.32001"
|
||||||
|
transform="rotate(0.01535728)"
|
||||||
|
r="33.171581" /><path
|
||||||
|
id="path3-6-1-0-2"
|
||||||
|
style="font-variation-settings:'wght' 700;fill:none;stroke:#195962;stroke-width:6.40174;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
d="m 563.52509,693.28894 a 35.520878,35.520878 0 0 1 -35.52088,35.52088 35.520878,35.520878 0 0 1 -35.52088,-35.52088 35.520878,35.520878 0 0 1 35.52088,-35.52088 35.520878,35.520878 0 0 1 35.52088,35.52088 z"
|
||||||
|
transform="rotate(22.152263)" /><g
|
||||||
|
id="g9-2-5-8-2"
|
||||||
|
transform="translate(-1.3219444,-1.6027733)"><path
|
||||||
|
d="m 221.1513,845.27224 c 0.0245,1.19424 -0.23692,2.22055 -0.78414,3.07896 -0.54765,0.83668 -1.38159,1.48371 -2.5018,1.94111 -1.12021,0.45737 -2.51629,0.70319 -4.18825,0.73743 -1.23765,0.0254 -2.3034,-0.0398 -3.19722,-0.19519 -0.40967,-0.0614 -0.81981,-0.1454 -1.2304,-0.25248 -0.81861,-0.21326 -1.47042,-1.16054 -1.48776,-2.00679 l -0.0193,-0.94161 c -0.0173,-0.84625 0.59808,-1.25531 1.40189,-0.99093 0.54067,0.1779 1.10164,0.33456 1.68292,0.47012 1.11318,0.2596 2.09317,0.38071 2.94,0.36338 0.95541,-0.0196 1.62563,-0.17459 2.01069,-0.46476 0.40678,-0.29073 0.6055,-0.66408 0.59616,-1.12009 -0.006,-0.30395 -0.0986,-0.57361 -0.27724,-0.80889 -0.15687,-0.23564 -0.50985,-0.50005 -1.05893,-0.79293 -0.54906,-0.29285 -1.40389,-0.66636 -2.56449,-1.1205 -1.11717,-0.45504 -2.0387,-0.90321 -2.76459,-1.3445 -0.72633,-0.46305 -1.26988,-1.0167 -1.63063,-1.66098 -0.36121,-0.66602 -0.55204,-1.49842 -0.57249,-2.49726 -0.0338,-1.65022 0.58141,-2.901 1.84562,-3.75236 1.2642,-0.85137 2.96027,-1.29882 5.08819,-1.3424 1.1074,-0.0227 2.16274,0.0643 3.166,0.26099 0.55248,0.10835 1.1157,0.25922 1.68968,0.45273 0.80179,0.27028 1.17351,1.19658 0.86143,1.98335 l -0.26453,0.66566 c -0.31266,0.78654 -1.20031,1.16326 -2.0021,0.89235 -0.36088,-0.12188 -0.71322,-0.23163 -1.057,-0.32905 -0.78701,-0.24462 -1.58224,-0.35863 -2.38563,-0.34218 -0.71656,0.0147 -1.25739,0.12356 -1.62252,0.32648 -0.34343,0.20264 -0.51112,0.49924 -0.50312,0.89009 0.006,0.28225 0.098,0.54105 0.27657,0.77636 0.19986,0.21314 0.56303,0.44464 1.0895,0.69452 0.54818,0.24942 1.34781,0.58068 2.39896,0.99362 1.029,0.39161 1.91729,0.80789 2.66487,1.24877 0.74715,0.41919 1.32306,0.96129 1.72768,1.62641 0.4259,0.64296 0.64974,1.49642 0.67154,2.5604 z m 8.40639,-11.1515 0.30142,14.71885 c 0.0173,0.84626 -0.6546,1.54635 -1.5009,1.56367 l -1.78842,0.0366 c -0.84626,0.0173 -1.54635,-0.6546 -1.56367,-1.5009 l -0.30141,-14.71886 c -0.0173,-0.84627 0.6546,-1.54636 1.5009,-1.56367 l 1.78841,-0.0366 c 0.84627,-0.0173 1.54636,0.6546 1.56367,1.50092 z m -2.58432,-8.45298 c 0.71654,-0.0147 1.33892,0.1463 1.86718,0.48309 0.52779,0.31507 0.80102,0.92856 0.8197,1.8405 0.0182,0.89027 -0.22965,1.51444 -0.74357,1.87258 -0.51404,0.35807 -1.12931,0.54445 -1.84585,0.55913 -0.73826,0.0151 -1.37152,-0.14564 -1.89976,-0.48242 -0.50653,-0.33721 -0.7689,-0.95093 -0.78714,-1.84119 -0.0187,-0.91197 0.21837,-1.53591 0.71111,-1.87186 0.51401,-0.35808 1.14015,-0.54469 1.87841,-0.5598 z m 13.39221,6.37288 c 1.08569,-0.0222 2.06723,0.17489 2.94469,0.5914 0.87743,0.41649 1.62903,1.05274 2.25479,1.90885 l 0.13022,-0.003 c 0.053,-1.62151 0.92731,-2.07451 1.82469,-2.0929 l 1.0393,-0.0213 c 0.84625,-0.0173 1.54634,0.6546 1.56365,1.50091 l 0.14972,16.1761 c 0.006,0.63934 -0.23499,1.62306 -0.66503,2.2835 -0.43004,0.66044 -1.6198,1.93803 -2.93234,2.55141 -1.31208,0.63511 -2.94522,0.97267 -4.89944,1.0127 -1.2594,0.0258 -2.43346,-0.0261 -3.52226,-0.15591 -0.5644,-0.0688 -1.12339,-0.17137 -1.677,-0.30716 -0.82165,-0.20163 -1.4805,-1.1291 -1.49782,-1.97537 l -0.0166,-0.8113 c -0.0173,-0.84624 0.6054,-1.27193 1.41728,-1.03366 0.63265,0.18566 1.27493,0.33315 1.92677,0.44237 1.17744,0.21474 2.3741,0.30981 3.59007,0.28491 1.25939,-0.0258 1.98092,-0.20257 2.81336,-0.83044 0.83244,-0.62787 0.89293,-1.80789 0.88606,-2.76748 -0.007,-0.9596 -0.0109,-0.89572 0.005,-1.20015 l -0.093,0.14247 c -0.58885,0.94616 -1.30245,1.63415 -2.14085,2.06405 -0.8384,0.4299 -1.78955,0.65574 -2.85352,0.67753 -2.10622,0.0431 -3.77289,-0.72647 -5.00005,-2.30882 -1.2059,-1.60451 -1.8384,-3.85073 -1.89754,-6.73862 -0.0596,-2.90961 0.50192,-5.19113 1.68453,-6.84455 1.18262,-1.65342 2.83789,-2.50193 4.96582,-2.54551 z m 1.61152,3.90968 c -0.75999,0.0156 -1.3963,0.235 -1.90898,0.65818 -0.4914,0.40107 -0.85915,1.00596 -1.10329,1.81472 -0.22283,0.78655 -0.32202,1.77699 -0.29756,2.97124 0.0365,1.78052 0.34608,3.1101 0.92888,3.9888 0.58233,0.85699 1.47062,1.27326 2.66486,1.2488 0.62971,-0.0129 1.17099,-0.0999 1.62385,-0.2613 0.45245,-0.18299 0.81602,-0.46201 1.09073,-0.83695 0.29598,-0.39705 0.51374,-0.90114 0.65333,-1.5122 0.1396,-0.6111 0.20037,-1.3509 0.18258,-2.21946 l -0.012,-0.58626 c -0.0262,-1.2811 -0.17753,-2.30982 -0.4542,-3.08619 -0.27657,-0.77636 -0.68982,-1.33268 -1.23979,-1.66898 -0.55038,-0.358 -1.25984,-0.52813 -2.12841,-0.51033 z"
|
||||||
|
style="font-size:13.2602px;font-family:'Noto Sans';-inkscape-font-specification:'Noto Sans, @wght=700';font-variation-settings:'wght' 700;display:inline;fill:#195962;stroke-width:10.8591;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
id="path1-2-8-5-7-1"
|
||||||
|
sodipodi:nodetypes="ccssccssssscccscccssssscsscscccccccccccssccssscscssscscsscsccsscszcscsssscszzccsscssccsccscsccsssscss" /><path
|
||||||
|
id="path4-4-4-6-72"
|
||||||
|
style="font-variation-settings:'wght' 700;display:inline;fill:none;stroke:#195962;stroke-width:3.64767;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
d="m 208.35953,828.56065 c 4.20155,-6.40232 11.67933,-11.91499 20.19969,-11.73012 8.20624,0.17805 13.83263,3.91368 19.70116,9.24107"
|
||||||
|
sodipodi:nodetypes="csc" /><path
|
||||||
|
id="path4-6-7-9-3-4"
|
||||||
|
style="font-variation-settings:'wght' 700;display:inline;fill:none;stroke:#195962;stroke-width:3.64767;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
d="m 248.51397,859.76996 c -5.73327,5.42971 -12.71409,8.56595 -19.29605,9.02109 -8.96638,0.62002 -15.41863,-3.91867 -20.7683,-10.62518"
|
||||||
|
sodipodi:nodetypes="csc" /></g></g></g></g><g
|
||||||
|
id="g67-9"
|
||||||
|
transform="translate(1087.6448,1186.1298)"
|
||||||
|
style="display:inline;stroke-width:1.7;stroke-dasharray:none"
|
||||||
|
inkscape:label="Signature enlarged"><rect
|
||||||
|
style="display:inline;opacity:1;fill:none;fill-opacity:1;stroke:#baa600;stroke-width:1.7;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:3.4, 3.4;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
id="rect66-2"
|
||||||
|
width="227.37041"
|
||||||
|
height="273.77692"
|
||||||
|
x="823.01019"
|
||||||
|
y="392.435"
|
||||||
|
ry="0" /><path
|
||||||
|
id="rect75"
|
||||||
|
d="M 823.02841,559.50607 H 997.323 c 3.3871,0 16.5171,7.28301 19.1581,12.10058 l 19.7678,43.64116 -26.0831,51.56825 H 823.02841 Z"
|
||||||
|
style="display:inline;opacity:0.6;fill:#ede8bf;fill-opacity:1;stroke:none;stroke-width:1.53892;stroke-linecap:round;stroke-miterlimit:0;stroke-dasharray:3.07784, 3.07784;stroke-dashoffset:0;stroke-opacity:0.4;paint-order:fill markers stroke"
|
||||||
|
sodipodi:nodetypes="csscccc" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:16.4356px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;white-space:pre;inline-size:136.539;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:2.69647;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="834.39349"
|
||||||
|
y="430.00592"
|
||||||
|
id="text11-2-8-96-6"
|
||||||
|
transform="translate(3.059981,-11.46164)"><tspan
|
||||||
|
x="834.39349"
|
||||||
|
y="430.00592"
|
||||||
|
id="tspan24"><tspan
|
||||||
|
style="font-weight:500;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium'"
|
||||||
|
id="tspan23">Subkey binding </tspan></tspan><tspan
|
||||||
|
x="834.39349"
|
||||||
|
y="450.70192"
|
||||||
|
id="tspan26"><tspan
|
||||||
|
style="font-weight:500;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium'"
|
||||||
|
id="tspan25">signature</tspan></tspan></text><g
|
||||||
|
id="g74"
|
||||||
|
transform="translate(-28,2)"
|
||||||
|
style="display:inline"><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:13.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Medium';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;white-space:pre;inline-size:202.099;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.21325;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="text11-9-0-0-9-2"
|
||||||
|
transform="matrix(1.0006928,0,0,0.99930768,-6.3988409,9.4064105)"><tspan
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="tspan27">- signature creation time</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:13.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Medium';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;white-space:pre;inline-size:202.099;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.21325;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="text11-9-0-0-9-2-5"
|
||||||
|
transform="matrix(1.0006928,0,0,0.99930768,-6.3988409,33.106446)"><tspan
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="tspan28">- key expiration time</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:13.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Medium';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;white-space:pre;inline-size:202.099;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.21325;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="text11-9-0-0-9-2-8"
|
||||||
|
transform="matrix(1.0006928,0,0,0.99930768,-6.3988409,56.806482)"><tspan
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="tspan29">- key flags</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:13.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Medium';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;white-space:pre;inline-size:202.099;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.21325;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="text11-9-0-0-9-2-0"
|
||||||
|
transform="matrix(1.0006928,0,0,0.99930768,-6.3988409,80.506517)"><tspan
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="tspan30">- issuer fingerprint</tspan></text></g><g
|
||||||
|
id="g75"
|
||||||
|
transform="translate(-22,-2)"
|
||||||
|
style="display:inline"><path
|
||||||
|
style="display:inline;fill:none;fill-opacity:1;stroke:#baa600;stroke-width:1.89036;stroke-linecap:square;stroke-dasharray:3.78071, 3.78071;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
d="m 1027.2752,198.75048 10.0643,-0.13796 a 22.802137,22.802137 31.076969 0 1 20.6184,12.42652 l 24.5853,48.12524 a 13.9317,13.9317 90.969948 0 1 -0.2217,13.09237 l -29.1779,52.63701"
|
||||||
|
id="path71-5-7-0-1"
|
||||||
|
sodipodi:nodetypes="cccc"
|
||||||
|
transform="matrix(0.84169236,0,0,0.84052739,145.60051,394.69147)"
|
||||||
|
inkscape:original-d="m 1027.2752,198.75048 24.2352,-0.33221 34.4071,67.3512 -32.7739,59.12419"
|
||||||
|
inkscape:path-effect="#path-effect71-63-4-8-9" /><path
|
||||||
|
style="display:inline;fill:none;fill-opacity:1;stroke:#baa600;stroke-width:1.89036;stroke-linecap:square;stroke-dasharray:3.78071, 3.78071;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
d="m 831.5444,198.75048 h 20.21188"
|
||||||
|
id="path71-5-7-0-1-1"
|
||||||
|
sodipodi:nodetypes="cc"
|
||||||
|
transform="matrix(0.84169236,0,0,0.84052739,146.02143,394.69147)"
|
||||||
|
inkscape:original-d="m 831.5444,198.75048 h 20.21188"
|
||||||
|
inkscape:path-effect="#path-effect71-63-4-8-9-9" /></g><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:13.0667px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:2.8271;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="843.21515"
|
||||||
|
y="564.68591"
|
||||||
|
id="text11-2-8-96-5"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-0-9"
|
||||||
|
x="843.21515"
|
||||||
|
y="564.68591"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:13.0667px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;stroke-width:2.8271">Additional Metadata</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:13.0667px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:2.8271;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="837.48114"
|
||||||
|
y="477.95938"
|
||||||
|
id="text11-2-8-96-5-4"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-0-9-9"
|
||||||
|
x="837.48114"
|
||||||
|
y="477.95938"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:13.0667px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;stroke-width:2.8271">Signature over:</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:13.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Medium';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;white-space:pre;inline-size:202.099;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.21325;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="text11-9-0-0-9-2-81"
|
||||||
|
transform="matrix(1.0006928,0,0,0.99930768,-39.649399,-71.34591)"><tspan
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="tspan31">- primary key</tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:13.3333px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Medium';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;text-anchor:start;white-space:pre;inline-size:202.099;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.21325;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="text11-9-0-0-9-2-5-9"
|
||||||
|
transform="matrix(1.0006928,0,0,0.99930768,-39.649399,-47.64587)"><tspan
|
||||||
|
x="876.12891"
|
||||||
|
y="573.06091"
|
||||||
|
id="tspan32">- subkey</tspan></text><path
|
||||||
|
style="opacity:1;fill:none;fill-opacity:1;stroke:#baa600;stroke-width:1.89906;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:0;stroke-dasharray:3.79812, 3.79812;stroke-dashoffset:0;stroke-opacity:1;marker-start:url(#marker72);paint-order:fill markers stroke"
|
||||||
|
d="M 630.03901,482.96191 820.471,482.93303"
|
||||||
|
id="path252-2"
|
||||||
|
sodipodi:nodetypes="cc" /></g><g
|
||||||
|
id="g10-8-7-3"
|
||||||
|
transform="matrix(0.55050909,0.33336718,-0.33336718,0.55050909,2250.4522,1141.2711)"
|
||||||
|
inkscape:label="Signature vers2"
|
||||||
|
style="display:inline;fill:#c83737"><circle
|
||||||
|
style="fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:14.841;stroke-linecap:square;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
id="path73-6-7"
|
||||||
|
cx="228.22922"
|
||||||
|
cy="841.32001"
|
||||||
|
transform="rotate(0.01535728)"
|
||||||
|
r="33.171581" /><path
|
||||||
|
id="path3-6-9-0"
|
||||||
|
style="font-variation-settings:'wght' 700;fill:none;stroke:#195962;stroke-width:6.40174;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
d="m 563.52509,693.28894 a 35.520878,35.520878 0 0 1 -35.52088,35.52088 35.520878,35.520878 0 0 1 -35.52088,-35.52088 35.520878,35.520878 0 0 1 35.52088,-35.52088 35.520878,35.520878 0 0 1 35.52088,35.52088 z"
|
||||||
|
transform="rotate(22.152263)" /><g
|
||||||
|
id="g9-2-1-6"
|
||||||
|
transform="translate(-1.3219444,-1.6027733)"><path
|
||||||
|
d="m 221.1513,845.27224 c 0.0245,1.19424 -0.23692,2.22055 -0.78414,3.07896 -0.54765,0.83668 -1.38159,1.48371 -2.5018,1.94111 -1.12021,0.45737 -2.51629,0.70319 -4.18825,0.73743 -1.23765,0.0254 -2.3034,-0.0398 -3.19722,-0.19519 -0.40967,-0.0614 -0.81981,-0.1454 -1.2304,-0.25248 -0.81861,-0.21326 -1.47042,-1.16054 -1.48776,-2.00679 l -0.0193,-0.94161 c -0.0173,-0.84625 0.59808,-1.25531 1.40189,-0.99093 0.54067,0.1779 1.10164,0.33456 1.68292,0.47012 1.11318,0.2596 2.09317,0.38071 2.94,0.36338 0.95541,-0.0196 1.62563,-0.17459 2.01069,-0.46476 0.40678,-0.29073 0.6055,-0.66408 0.59616,-1.12009 -0.006,-0.30395 -0.0986,-0.57361 -0.27724,-0.80889 -0.15687,-0.23564 -0.50985,-0.50005 -1.05893,-0.79293 -0.54906,-0.29285 -1.40389,-0.66636 -2.56449,-1.1205 -1.11717,-0.45504 -2.0387,-0.90321 -2.76459,-1.3445 -0.72633,-0.46305 -1.26988,-1.0167 -1.63063,-1.66098 -0.36121,-0.66602 -0.55204,-1.49842 -0.57249,-2.49726 -0.0338,-1.65022 0.58141,-2.901 1.84562,-3.75236 1.2642,-0.85137 2.96027,-1.29882 5.08819,-1.3424 1.1074,-0.0227 2.16274,0.0643 3.166,0.26099 0.55248,0.10835 1.1157,0.25922 1.68968,0.45273 0.80179,0.27028 1.17351,1.19658 0.86143,1.98335 l -0.26453,0.66566 c -0.31266,0.78654 -1.20031,1.16326 -2.0021,0.89235 -0.36088,-0.12188 -0.71322,-0.23163 -1.057,-0.32905 -0.78701,-0.24462 -1.58224,-0.35863 -2.38563,-0.34218 -0.71656,0.0147 -1.25739,0.12356 -1.62252,0.32648 -0.34343,0.20264 -0.51112,0.49924 -0.50312,0.89009 0.006,0.28225 0.098,0.54105 0.27657,0.77636 0.19986,0.21314 0.56303,0.44464 1.0895,0.69452 0.54818,0.24942 1.34781,0.58068 2.39896,0.99362 1.029,0.39161 1.91729,0.80789 2.66487,1.24877 0.74715,0.41919 1.32306,0.96129 1.72768,1.62641 0.4259,0.64296 0.64974,1.49642 0.67154,2.5604 z m 8.40639,-11.1515 0.30142,14.71885 c 0.0173,0.84626 -0.6546,1.54635 -1.5009,1.56367 l -1.78842,0.0366 c -0.84626,0.0173 -1.54635,-0.6546 -1.56367,-1.5009 l -0.30141,-14.71886 c -0.0173,-0.84627 0.6546,-1.54636 1.5009,-1.56367 l 1.78841,-0.0366 c 0.84627,-0.0173 1.54636,0.6546 1.56367,1.50092 z m -2.58432,-8.45298 c 0.71654,-0.0147 1.33892,0.1463 1.86718,0.48309 0.52779,0.31507 0.80102,0.92856 0.8197,1.8405 0.0182,0.89027 -0.22965,1.51444 -0.74357,1.87258 -0.51404,0.35807 -1.12931,0.54445 -1.84585,0.55913 -0.73826,0.0151 -1.37152,-0.14564 -1.89976,-0.48242 -0.50653,-0.33721 -0.7689,-0.95093 -0.78714,-1.84119 -0.0187,-0.91197 0.21837,-1.53591 0.71111,-1.87186 0.51401,-0.35808 1.14015,-0.54469 1.87841,-0.5598 z m 13.39221,6.37288 c 1.08569,-0.0222 2.06723,0.17489 2.94469,0.5914 0.87743,0.41649 1.62903,1.05274 2.25479,1.90885 l 0.13022,-0.003 c 0.053,-1.62151 0.92731,-2.07451 1.82469,-2.0929 l 1.0393,-0.0213 c 0.84625,-0.0173 1.54634,0.6546 1.56365,1.50091 l 0.14972,16.1761 c 0.006,0.63934 -0.23499,1.62306 -0.66503,2.2835 -0.43004,0.66044 -1.6198,1.93803 -2.93234,2.55141 -1.31208,0.63511 -2.94522,0.97267 -4.89944,1.0127 -1.2594,0.0258 -2.43346,-0.0261 -3.52226,-0.15591 -0.5644,-0.0688 -1.12339,-0.17137 -1.677,-0.30716 -0.82165,-0.20163 -1.4805,-1.1291 -1.49782,-1.97537 l -0.0166,-0.8113 c -0.0173,-0.84624 0.6054,-1.27193 1.41728,-1.03366 0.63265,0.18566 1.27493,0.33315 1.92677,0.44237 1.17744,0.21474 2.3741,0.30981 3.59007,0.28491 1.25939,-0.0258 1.98092,-0.20257 2.81336,-0.83044 0.83244,-0.62787 0.89293,-1.80789 0.88606,-2.76748 -0.007,-0.9596 -0.0109,-0.89572 0.005,-1.20015 l -0.093,0.14247 c -0.58885,0.94616 -1.30245,1.63415 -2.14085,2.06405 -0.8384,0.4299 -1.78955,0.65574 -2.85352,0.67753 -2.10622,0.0431 -3.77289,-0.72647 -5.00005,-2.30882 -1.2059,-1.60451 -1.8384,-3.85073 -1.89754,-6.73862 -0.0596,-2.90961 0.50192,-5.19113 1.68453,-6.84455 1.18262,-1.65342 2.83789,-2.50193 4.96582,-2.54551 z m 1.61152,3.90968 c -0.75999,0.0156 -1.3963,0.235 -1.90898,0.65818 -0.4914,0.40107 -0.85915,1.00596 -1.10329,1.81472 -0.22283,0.78655 -0.32202,1.77699 -0.29756,2.97124 0.0365,1.78052 0.34608,3.1101 0.92888,3.9888 0.58233,0.85699 1.47062,1.27326 2.66486,1.2488 0.62971,-0.0129 1.17099,-0.0999 1.62385,-0.2613 0.45245,-0.18299 0.81602,-0.46201 1.09073,-0.83695 0.29598,-0.39705 0.51374,-0.90114 0.65333,-1.5122 0.1396,-0.6111 0.20037,-1.3509 0.18258,-2.21946 l -0.012,-0.58626 c -0.0262,-1.2811 -0.17753,-2.30982 -0.4542,-3.08619 -0.27657,-0.77636 -0.68982,-1.33268 -1.23979,-1.66898 -0.55038,-0.358 -1.25984,-0.52813 -2.12841,-0.51033 z"
|
||||||
|
style="font-size:13.2602px;font-family:'Noto Sans';-inkscape-font-specification:'Noto Sans, @wght=700';font-variation-settings:'wght' 700;display:inline;fill:#195962;stroke-width:10.8591;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
|
id="path1-2-8-1-9"
|
||||||
|
sodipodi:nodetypes="ccssccssssscccscccssssscsscscccccccccccssccssscscssscscsscsccsscszcscsssscszzccsscssccsccscsccsssscss" /><path
|
||||||
|
id="path4-4-9-2"
|
||||||
|
style="font-variation-settings:'wght' 700;display:inline;fill:none;stroke:#195962;stroke-width:3.64767;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
d="m 208.35953,828.56065 c 4.20155,-6.40232 11.67933,-11.91499 20.19969,-11.73012 8.20624,0.17805 13.83263,3.91368 19.70116,9.24107"
|
||||||
|
sodipodi:nodetypes="csc" /><path
|
||||||
|
id="path4-6-7-0-1"
|
||||||
|
style="font-variation-settings:'wght' 700;display:inline;fill:none;stroke:#195962;stroke-width:3.64767;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
d="m 248.51397,859.76996 c -5.73327,5.42971 -12.71409,8.56595 -19.29605,9.02109 -8.96638,0.62002 -15.41863,-3.91867 -20.7683,-10.62518"
|
||||||
|
sodipodi:nodetypes="csc" /></g></g><path
|
||||||
|
style="fill:none;stroke:#195a63;stroke-width:2.475;stroke-linecap:round;stroke-dasharray:4.95, 4.95;stroke-dashoffset:0;stroke-opacity:1;marker-start:url(#Square);marker-end:url(#Triangle-3);paint-order:fill markers stroke"
|
||||||
|
d="m 1288.2134,1474.5697 -251.0944,-0.1332 a 11.206732,11.206732 135.01519 0 0 -11.2127,11.2068 v 131.4249"
|
||||||
|
id="path48-70"
|
||||||
|
transform="matrix(-1,0,0,1,3123.2879,22.887535)"
|
||||||
|
sodipodi:nodetypes="ccc"
|
||||||
|
inkscape:path-effect="#path-effect69-6"
|
||||||
|
inkscape:original-d="m 1288.2134,1474.5697 -262.3071,-0.1391 v 142.6376" /></g></g></g></svg>
|
||||||
|
After Width: | Height: | Size: 67 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 82 KiB After Width: | Height: | Size: 121 KiB |
49
book/source/mermaid/06-terminology.md
Normal file
49
book/source/mermaid/06-terminology.md
Normal file
|
|
@ -0,0 +1,49 @@
|
||||||
|
```{mermaid}
|
||||||
|
%%{ init: { 'flowchart': { 'curve': '' } } }%%
|
||||||
|
flowchart LR
|
||||||
|
signature(OpenPGP Signature)
|
||||||
|
3rdcert(Third-Party Certification)
|
||||||
|
data(Data Signature)
|
||||||
|
selfcert(Self-Signature)
|
||||||
|
certification("Third-Party Certification
|
||||||
|
--------------------------------
|
||||||
|
Self-Certification")
|
||||||
|
|
||||||
|
signature --> data & selfcert & 3rdcert & confsig & standalone & timestamp
|
||||||
|
data --> binary & text
|
||||||
|
selfcert --> skbind & skrev
|
||||||
|
selfcert & 3rdcert --> certification
|
||||||
|
certification --> uidcert & uidrev & dksig & krev
|
||||||
|
subgraph Siganture Types and Targets
|
||||||
|
standalone[0x02: Standalone]
|
||||||
|
subgraph Signature Packet
|
||||||
|
confsig[0x50: Third-Party Confirmation]
|
||||||
|
timestamp[0x40: Timestamp]
|
||||||
|
end
|
||||||
|
subgraph Data
|
||||||
|
binary[0x00: Binary Data]
|
||||||
|
text[0x01: Canonical Text]
|
||||||
|
end
|
||||||
|
subgraph Primary Key + User ID / Attr. Packet
|
||||||
|
uidcert[
|
||||||
|
0x10: Generic Certification
|
||||||
|
0x11: Persona Certification
|
||||||
|
0x12: Casual Certification
|
||||||
|
0x13: Positive Certification
|
||||||
|
]
|
||||||
|
uidrev[0x30: Certification Revocation]
|
||||||
|
end
|
||||||
|
subgraph Primary Key
|
||||||
|
dksig[0x1F: Direct-Key Signature]
|
||||||
|
krev[0x20: Key Revocation]
|
||||||
|
end
|
||||||
|
subgraph Primary + Subkey
|
||||||
|
skbind[
|
||||||
|
0x18: Subkey Binding
|
||||||
|
0x19: Primary Key Binding
|
||||||
|
]
|
||||||
|
skrev[0x28: Subkey Revocation]
|
||||||
|
end
|
||||||
|
end
|
||||||
|
```
|
||||||
|
|
||||||
BIN
book/source/mermaid/06-terminology.png
Normal file
BIN
book/source/mermaid/06-terminology.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 138 KiB |
Loading…
Reference in a new issue