David says the signature type diagram is confusing, maybe it needs more explanation?

I suppose the (at least) 2x2 Matrix of types of component signatures is hard to make sense of, and hard to visualize.
This commit is contained in:
Heiko Schaefer 2023-11-03 16:58:43 +01:00
parent 4d8ade3502
commit 384f26c1bc
No known key found for this signature in database
GPG key ID: 4A849A1904CCBD7D

View file

@ -28,15 +28,26 @@ For the purpose of this document, the term signature will refer to OpenPGP signa
The OpenPGP standard defines a set of [Signature Types](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-types), each identified by a numerical *signature type ID*. Signature types define the intent of a signature, and how it needs to be interpreted.
Most OpenPGP signature types can be classified as either:
- *Signatures over data* (type IDs `0x00` and `0x01`), or
- *Signatures on components* (that is: signatures that apply to component keys or identity components).
Signature on components are a complex topic, which we discuss in depth in {ref}`component_signatures_chapter`. They are grouped in two dimensions:
- Who issued the signature (self-signature vs. third party signature)?
- What kind of statement does the signature make (certify an identity, or bind component keys into a certificate)?
```{figure} mermaid/06-terminology.png
An overview of signature types in OpenPGP
```
Most OpenPGP signature types can be classified as either:
```{admonition} TODO
:class: warning
- *Signatures over data*, or
- *Signatures on components* (that is: signatures that apply to component keys or identity components).
Group "Third-Party Certification" and "Self-Signature" as "Signature on components", in the diagram?
```
In this chapter, we discuss the general principles of OpenPGP signatures, which apply to all types of OpenPGP signatures.