When I decrypt a file in OpenPGP (in Golang), I receive this error message:

unsupported feature: nested signatures

There is very little clear information about this kind of signature.

In RFC 4880, under One-Pass Signature Packets, it says that:

The body of this packet consists of:

  • A one-octet version number. The current version is 3.
  • A one-octet signature type. Signature types are described in Section 5.2.1.
  • A one-octet number describing the hash algorithm used.

  • A one-octet number describing the public-key algorithm used.

  • An eight-octet number holding the Key ID of the signing key.
  • A one-octet number holding a flag showing whether the signature is nested. A zero value indicates that the next packet is another One-Pass Signature packet that describes another signature to be applied to the same message data.

    Note that if a message contains more than one one-pass signature,
    then the Signature packets bracket the message; that is, the first
    Signature packet after the message corresponds to the last one-pass
    packet and the final Signature packet corresponds to the first
    one-pass packet.

However, I simply can't understand what "bracket the message" means. Could someone explain it more clearly? Thanks.

  • 1
    $\begingroup$ This Q/A site is about cryptographic uses only. I'll not close the question as it is basically about understanding the protocol / nested signatures. However, "how to decrypt it in openPGP" is a tooling related question and therefore strictly optional in any answer (besides that, the error message is pretty clear I think, and just looking at the bug database for feature requests seems more productive). $\endgroup$ – Maarten Bodewes Aug 13 '19 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.