I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both.
One reason states that the message must be compressed first and signed later because if we need to do any future validation, we only need to store the signature – but what I think is if we do the signature first and compression later, we also need to store the signature and compression value. So it will be same as we do the signature first, followed by the compression. Either way, we also need to store the signature and compression value for future validation.
And then there is the second reason… which I do not understand at all:
Even if one were willing to generate dynamically a recompressed message for verification, PGP's compression algorithm presents a difficulty. The algorithm is not deterministic; various implementations of the algorithm achieve different tradeoffs in running speed versus compression ratio and, as a result, produce different compressed forms. However, these different compression algorithms are interoperable because any version of the algorithm can correctly decompress the output of any other version. Applying the hash function and signature after compression would constrain all PGP implementations to the same version of the compression algorithm
(This 2nd reason is from William Stalling’s book “Cryptography and Network Security”, 4th edition.)
Can anyone help me understand both reasons (especially the later), and/or can you explain to me why PGP expects us to generate the signature before compressing?