4. Packet Syntax
This section describes the packets used by OpenPGP.
An OpenPGP message is constructed from a number of records that are
traditionally called packets. A packet is a chunk of data that has a
tag specifying its meaning. An OpenPGP message, keyring,
certificate, and so forth consists of a number of packets. Some of
those packets may contain other OpenPGP packets (for example, a
compressed data packet, when uncompressed, contains OpenPGP packets).
Each packet consists of a packet header, followed by the packet body.
The packet header is of variable length.
4.2. Packet Headers
The first octet of the packet header is called the "Packet Tag". It
determines the format of the header and denotes the packet contents.
The remainder of the packet header is the length of the packet.
Note that the most significant bit is the leftmost bit, called bit 7.
A mask for this bit is 0x80 in hexadecimal.
PTag |7 6 5 4 3 2 1 0|
Bit 7 -- Always one
Bit 6 -- New packet format if set
PGP 2.6.x only uses old format packets. Thus, software that
interoperates with those versions of PGP must only use old format
packets. If interoperability is not an issue, the new packet format
is RECOMMENDED. Note that old format packets have four bits of
packet tags, and new format packets have six; some features cannot be
used and still be backward-compatible.
Also note that packets with a tag greater than or equal to 16 MUST
use new format packets. The old format packets can only express tags
less than or equal to 15.
Old format packets contain:
Bits 5-2 -- packet tag
Bits 1-0 -- length-type
New format packets contain:
Bits 5-0 -- packet tag
4.2.1. Old Format Packet Lengths
The meaning of the length-type in old format packets is:
0 - The packet has a one-octet length. The header is 2 octets long.
1 - The packet has a two-octet length. The header is 3 octets long.
2 - The packet has a four-octet length. The header is 5 octets long.
3 - The packet is of indeterminate length. The header is 1 octet
long, and the implementation must determine how long the packet
is. If the packet is in a file, this means that the packet
extends until the end of the file. In general, an implementation
SHOULD NOT use indeterminate-length packets except where the end
of the data will be clear from the context, and even then it is
better to use a definite length, or a new format header. The new
format headers described below have a mechanism for precisely
encoding data of indeterminate length.
4.2.2. New Format Packet Lengths
New format packets have four possible ways of encoding length:
1. A one-octet Body Length header encodes packet lengths of up to 191
2. A two-octet Body Length header encodes packet lengths of 192 to
3. A five-octet Body Length header encodes packet lengths of up to
4,294,967,295 (0xFFFFFFFF) octets in length. (This actually
encodes a four-octet scalar number.)
4. When the length of the packet body is not known in advance by the
issuer, Partial Body Length headers encode a packet of
indeterminate length, effectively making it a stream.
18.104.22.168. One-Octet Lengths
A one-octet Body Length header encodes a length of 0 to 191 octets.
This type of length header is recognized because the one octet value
is less than 192. The body length is equal to:
bodyLen = 1st_octet;
22.214.171.124. Two-Octet Lengths
A two-octet Body Length header encodes a length of 192 to 8383
octets. It is recognized because its first octet is in the range 192
to 223. The body length is equal to:
bodyLen = ((1st_octet - 192) << 8) + (2nd_octet) + 192
126.96.36.199. Five-Octet Lengths
A five-octet Body Length header consists of a single octet holding
the value 255, followed by a four-octet scalar. The body length is
bodyLen = (2nd_octet << 24) | (3rd_octet << 16) |
(4th_octet << 8) | 5th_octet
This basic set of one, two, and five-octet lengths is also used
internally to some packets.
188.8.131.52. Partial Body Lengths
A Partial Body Length header is one octet long and encodes the length
of only part of the data packet. This length is a power of 2, from 1
to 1,073,741,824 (2 to the 30th power). It is recognized by its one
octet value that is greater than or equal to 224, and less than 255.
The Partial Body Length is equal to:
partialBodyLen = 1 << (1st_octet & 0x1F);
Each Partial Body Length header is followed by a portion of the
packet body data. The Partial Body Length header specifies this
portion's length. Another length header (one octet, two-octet,
five-octet, or partial) follows that portion. The last length header
in the packet MUST NOT be a Partial Body Length header. Partial Body
Length headers may only be used for the non-final parts of the
Note also that the last Body Length header can be a zero-length
An implementation MAY use Partial Body Lengths for data packets, be
they literal, compressed, or encrypted. The first partial length
MUST be at least 512 octets long. Partial Body Lengths MUST NOT be
used for any other packet types.
4.2.3. Packet Length Examples
These examples show ways that new format packets might encode the
A packet with length 100 may have its length encoded in one octet:
0x64. This is followed by 100 octets of data.
A packet with length 1723 may have its length encoded in two octets:
0xC5, 0xFB. This header is followed by the 1723 octets of data.
A packet with length 100000 may have its length encoded in five
octets: 0xFF, 0x00, 0x01, 0x86, 0xA0.
It might also be encoded in the following octet stream: 0xEF, first
32768 octets of data; 0xE1, next two octets of data; 0xE0, next one
octet of data; 0xF0, next 65536 octets of data; 0xC5, 0xDD, last 1693
octets of data. This is just one possible encoding, and many
variations are possible on the size of the Partial Body Length
headers, as long as a regular Body Length header encodes the last
portion of the data.
Please note that in all of these explanations, the total length of
the packet is the length of the header(s) plus the length of the
4.3. Packet Tags
The packet tag denotes what type of packet the body holds. Note that
old format headers can only have tags less than 16, whereas new
format headers can have tags as great as 63. The defined tags (in
decimal) are as follows:
0 -- Reserved - a packet tag MUST NOT have this value
1 -- Public-Key Encrypted Session Key Packet
2 -- Signature Packet
3 -- Symmetric-Key Encrypted Session Key Packet
4 -- One-Pass Signature Packet
5 -- Secret-Key Packet
6 -- Public-Key Packet
7 -- Secret-Subkey Packet
8 -- Compressed Data Packet
9 -- Symmetrically Encrypted Data Packet
10 -- Marker Packet
11 -- Literal Data Packet
12 -- Trust Packet
13 -- User ID Packet
14 -- Public-Subkey Packet
17 -- User Attribute Packet
18 -- Sym. Encrypted and Integrity Protected Data Packet
19 -- Modification Detection Code Packet
60 to 63 -- Private or Experimental Values
5. Packet Types
5.1. Public-Key Encrypted Session Key Packets (Tag 1)
A Public-Key Encrypted Session Key packet holds the session key used
to encrypt a message. Zero or more Public-Key Encrypted Session Key
packets and/or Symmetric-Key Encrypted Session Key packets may
precede a Symmetrically Encrypted Data Packet, which holds an
encrypted message. The message is encrypted with the session key,
and the session key is itself encrypted and stored in the Encrypted
Session Key packet(s). The Symmetrically Encrypted Data Packet is
preceded by one Public-Key Encrypted Session Key packet for each
OpenPGP key to which the message is encrypted. The recipient of the
message finds a session key that is encrypted to their public key,
decrypts the session key, and then uses the session key to decrypt
The body of this packet consists of:
- A one-octet number giving the version number of the packet type.
The currently defined value for packet version is 3.
- An eight-octet number that gives the Key ID of the public key to
which the session key is encrypted. If the session key is
encrypted to a subkey, then the Key ID of this subkey is used
here instead of the Key ID of the primary key.
- A one-octet number giving the public-key algorithm used.
- A string of octets that is the encrypted session key. This
string takes up the remainder of the packet, and its contents are
dependent on the public-key algorithm used.
Algorithm Specific Fields for RSA encryption
- multiprecision integer (MPI) of RSA encrypted value m**e mod n.
Algorithm Specific Fields for Elgamal encryption:
- MPI of Elgamal (Diffie-Hellman) value g**k mod p.
- MPI of Elgamal (Diffie-Hellman) value m * y**k mod p.
The value "m" in the above formulas is derived from the session key
as follows. First, the session key is prefixed with a one-octet
algorithm identifier that specifies the symmetric encryption
algorithm used to encrypt the following Symmetrically Encrypted Data
Packet. Then a two-octet checksum is appended, which is equal to the
sum of the preceding session key octets, not including the algorithm
identifier, modulo 65536. This value is then encoded as described in
PKCS#1 block encoding EME-PKCS1-v1_5 in Section 7.2.1 of [RFC3447] to
form the "m" value used in the formulas above. See Section 13.1 of
this document for notes on OpenPGP's use of PKCS#1.
Note that when an implementation forms several PKESKs with one
session key, forming a message that can be decrypted by several keys,
the implementation MUST make a new PKCS#1 encoding for each key.
An implementation MAY accept or use a Key ID of zero as a "wild card"
or "speculative" Key ID. In this case, the receiving implementation
would try all available private keys, checking for a valid decrypted
session key. This format helps reduce traffic analysis of messages.
5.2. Signature Packet (Tag 2)
A Signature packet describes a binding between some public key and
some data. The most common signatures are a signature of a file or a
block of text, and a signature that is a certification of a User ID.
Two versions of Signature packets are defined. Version 3 provides
basic signature information, while version 4 provides an expandable
format with subpackets that can specify more information about the
signature. PGP 2.6.x only accepts version 3 signatures.
Implementations SHOULD accept V3 signatures. Implementations SHOULD
generate V4 signatures.
Note that if an implementation is creating an encrypted and signed
message that is encrypted to a V3 key, it is reasonable to create a
5.2.1. Signature Types
There are a number of possible meanings for a signature, which are
indicated in a signature type octet in any given signature. Please
note that the vagueness of these meanings is not a flaw, but a
feature of the system. Because OpenPGP places final authority for
validity upon the receiver of a signature, it may be that one
signer's casual act might be more rigorous than some other
authority's positive act. See Section 5.2.4, "Computing Signatures",
for detailed information on how to compute and verify signatures of
These meanings are as follows:
0x00: Signature of a binary document.
This means the signer owns it, created it, or certifies that it
has not been modified.
0x01: Signature of a canonical text document.
This means the signer owns it, created it, or certifies that it
has not been modified. The signature is calculated over the text
data with its line endings converted to <CR><LF>.
0x02: Standalone signature.
This signature is a signature of only its own subpacket contents.
It is calculated identically to a signature over a zero-length
binary document. Note that it doesn't make sense to have a V3
0x10: Generic certification of a User ID and Public-Key packet.
The issuer of this certification does not make any particular
assertion as to how well the certifier has checked that the owner
of the key is in fact the person described by the User ID.
0x11: Persona certification of a User ID and Public-Key packet.
The issuer of this certification has not done any verification of
the claim that the owner of this key is the User ID specified.
0x12: Casual certification of a User ID and Public-Key packet.
The issuer of this certification has done some casual
verification of the claim of identity.
0x13: Positive certification of a User ID and Public-Key packet.
The issuer of this certification has done substantial
verification of the claim of identity.
Most OpenPGP implementations make their "key signatures" as 0x10
certifications. Some implementations can issue 0x11-0x13
certifications, but few differentiate between the types.
0x18: Subkey Binding Signature
This signature is a statement by the top-level signing key that
indicates that it owns the subkey. This signature is calculated
directly on the primary key and subkey, and not on any User ID or
other packets. A signature that binds a signing subkey MUST have
an Embedded Signature subpacket in this binding signature that
contains a 0x19 signature made by the signing subkey on the
primary key and subkey.
0x19: Primary Key Binding Signature
This signature is a statement by a signing subkey, indicating
that it is owned by the primary key and subkey. This signature
is calculated the same way as a 0x18 signature: directly on the
primary key and subkey, and not on any User ID or other packets.
0x1F: Signature directly on a key
This signature is calculated directly on a key. It binds the
information in the Signature subpackets to the key, and is
appropriate to be used for subpackets that provide information
about the key, such as the Revocation Key subpacket. It is also
appropriate for statements that non-self certifiers want to make
about the key itself, rather than the binding between a key and a
0x20: Key revocation signature
The signature is calculated directly on the key being revoked. A
revoked key is not to be used. Only revocation signatures by the
key being revoked, or by an authorized revocation key, should be
considered valid revocation signatures.
0x28: Subkey revocation signature
The signature is calculated directly on the subkey being revoked.
A revoked subkey is not to be used. Only revocation signatures
by the top-level signature key that is bound to this subkey, or
by an authorized revocation key, should be considered valid
0x30: Certification revocation signature
This signature revokes an earlier User ID certification signature
(signature class 0x10 through 0x13) or direct-key signature
(0x1F). It should be issued by the same key that issued the
revoked signature or an authorized revocation key. The signature
is computed over the same data as the certificate that it
revokes, and should have a later creation date than that
0x40: Timestamp signature.
This signature is only meaningful for the timestamp contained in
0x50: Third-Party Confirmation signature.
This signature is a signature over some other OpenPGP Signature
packet(s). It is analogous to a notary seal on the signed data.
A third-party signature SHOULD include Signature Target
subpacket(s) to give easy identification. Note that we really do
mean SHOULD. There are plausible uses for this (such as a blind
party that only sees the signature, not the key or source
document) that cannot include a target subpacket.
5.2.2. Version 3 Signature Packet Format
The body of a version 3 Signature Packet contains:
- One-octet version number (3).
- One-octet length of following hashed material. MUST be 5.
- One-octet signature type.
- Four-octet creation time.
- Eight-octet Key ID of signer.
- One-octet public-key algorithm.
- One-octet hash algorithm.
- Two-octet field holding left 16 bits of signed hash value.
- One or more multiprecision integers comprising the signature.
This portion is algorithm specific, as described below.
The concatenation of the data to be signed, the signature type, and
creation time from the Signature packet (5 additional octets) is
hashed. The resulting hash value is used in the signature algorithm.
The high 16 bits (first two octets) of the hash are included in the
Signature packet to provide a quick test to reject some invalid
Algorithm-Specific Fields for RSA signatures:
- multiprecision integer (MPI) of RSA signature value m**d mod n.
Algorithm-Specific Fields for DSA signatures:
- MPI of DSA value r.
- MPI of DSA value s.
The signature calculation is based on a hash of the signed data, as
described above. The details of the calculation are different for
DSA signatures than for RSA signatures.
With RSA signatures, the hash value is encoded using PKCS#1 encoding
type EMSA-PKCS1-v1_5 as described in Section 9.2 of RFC 3447. This
requires inserting the hash value as an octet string into an ASN.1
structure. The object identifier for the type of hash being used is
included in the structure. The hexadecimal representations for the
currently defined hash algorithms are as follows:
- MD5: 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05
- RIPEMD-160: 0x2B, 0x24, 0x03, 0x02, 0x01
- SHA-1: 0x2B, 0x0E, 0x03, 0x02, 0x1A
- SHA224: 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
- SHA256: 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
- SHA384: 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
If the output size of the chosen hash is larger than the number of
bits of q, the hash result is truncated to fit by taking the number
of leftmost bits equal to the number of bits of q. This (possibly
truncated) hash function result is treated as a number and used
directly in the DSA signature algorithm.
5.2.3. Version 4 Signature Packet Format
The body of a version 4 Signature packet contains:
- One-octet version number (4).
- One-octet signature type.
- One-octet public-key algorithm.
- One-octet hash algorithm.
- Two-octet scalar octet count for following hashed subpacket data.
Note that this is the length in octets of all of the hashed
subpackets; a pointer incremented by this number will skip over
the hashed subpackets.
- Hashed subpacket data set (zero or more subpackets).
- Two-octet scalar octet count for the following unhashed subpacket
data. Note that this is the length in octets of all of the
unhashed subpackets; a pointer incremented by this number will
skip over the unhashed subpackets.
- Unhashed subpacket data set (zero or more subpackets).
- Two-octet field holding the left 16 bits of the signed hash
- One or more multiprecision integers comprising the signature.
This portion is algorithm specific, as described above.
The concatenation of the data being signed and the signature data
from the version number through the hashed subpacket data (inclusive)
is hashed. The resulting hash value is what is signed. The left 16
bits of the hash are included in the Signature packet to provide a
quick test to reject some invalid signatures.
There are two fields consisting of Signature subpackets. The first
field is hashed with the rest of the signature data, while the second
is unhashed. The second set of subpackets is not cryptographically
protected by the signature and should include only advisory
The algorithms for converting the hash function result to a signature
are described in a section below.
184.108.40.206. Signature Subpacket Specification
A subpacket data set consists of zero or more Signature subpackets.
In Signature packets, the subpacket data set is preceded by a two-
octet scalar count of the length in octets of all the subpackets. A
pointer incremented by this number will skip over the subpacket data
Each subpacket consists of a subpacket header and a body. The header
- the subpacket length (1, 2, or 5 octets),
- the subpacket type (1 octet),
and is followed by the subpacket-specific data.
The length includes the type octet but not this length. Its format
is similar to the "new" format packet header lengths, but cannot have
Partial Body Lengths. That is:
if the 1st octet < 192, then
lengthOfLength = 1
subpacketLen = 1st_octet
if the 1st octet >= 192 and < 255, then
lengthOfLength = 2
subpacketLen = ((1st_octet - 192) << 8) + (2nd_octet) + 192
if the 1st octet = 255, then
lengthOfLength = 5
subpacket length = [four-octet scalar starting at 2nd_octet]
The value of the subpacket type octet may be:
0 = Reserved
1 = Reserved
2 = Signature Creation Time
3 = Signature Expiration Time
4 = Exportable Certification
5 = Trust Signature
6 = Regular Expression
7 = Revocable
8 = Reserved
9 = Key Expiration Time
10 = Placeholder for backward compatibility
11 = Preferred Symmetric Algorithms
12 = Revocation Key
13 = Reserved
14 = Reserved
15 = Reserved
16 = Issuer
17 = Reserved
18 = Reserved
19 = Reserved
20 = Notation Data
21 = Preferred Hash Algorithms
22 = Preferred Compression Algorithms
23 = Key Server Preferences
24 = Preferred Key Server
25 = Primary User ID
26 = Policy URI
27 = Key Flags
28 = Signer's User ID
29 = Reason for Revocation
30 = Features
31 = Signature Target
32 = Embedded Signature
100 To 110 = Private or experimental
An implementation SHOULD ignore any subpacket of a type that it does
Bit 7 of the subpacket type is the "critical" bit. If set, it
denotes that the subpacket is one that is critical for the evaluator
of the signature to recognize. If a subpacket is encountered that is
marked critical but is unknown to the evaluating software, the
evaluator SHOULD consider the signature to be in error.
An evaluator may "recognize" a subpacket, but not implement it. The
purpose of the critical bit is to allow the signer to tell an
evaluator that it would prefer a new, unknown feature to generate an
error than be ignored.
Implementations SHOULD implement the three preferred algorithm
subpackets (11, 21, and 22), as well as the "Reason for Revocation"
subpacket. Note, however, that if an implementation chooses not to
implement some of the preferences, it is required to behave in a
polite manner to respect the wishes of those users who do implement
220.127.116.11. Signature Subpacket Types
A number of subpackets are currently defined. Some subpackets apply
to the signature itself and some are attributes of the key.
Subpackets that are found on a self-signature are placed on a
certification made by the key itself. Note that a key may have more
than one User ID, and thus may have more than one self-signature, and
A subpacket may be found either in the hashed or unhashed subpacket
sections of a signature. If a subpacket is not hashed, then the
information in it cannot be considered definitive because it is not
part of the signature proper.
18.104.22.168. Notes on Self-Signatures
A self-signature is a binding signature made by the key to which the
signature refers. There are three types of self-signatures, the
certification signatures (types 0x10-0x13), the direct-key signature
(type 0x1F), and the subkey binding signature (type 0x18). For
certification self-signatures, each User ID may have a self-
signature, and thus different subpackets in those self-signatures.
For subkey binding signatures, each subkey in fact has a self-
signature. Subpackets that appear in a certification self-signature
apply to the user name, and subpackets that appear in the subkey
self-signature apply to the subkey. Lastly, subpackets on the
direct-key signature apply to the entire key.
Implementing software should interpret a self-signature's preference
subpackets as narrowly as possible. For example, suppose a key has
two user names, Alice and Bob. Suppose that Alice prefers the
symmetric algorithm CAST5, and Bob prefers IDEA or TripleDES. If the
software locates this key via Alice's name, then the preferred
algorithm is CAST5; if software locates the key via Bob's name, then
the preferred algorithm is IDEA. If the key is located by Key ID,
the algorithm of the primary User ID of the key provides the
preferred symmetric algorithm.
Revoking a self-signature or allowing it to expire has a semantic
meaning that varies with the signature type. Revoking the self-
signature on a User ID effectively retires that user name. The
self-signature is a statement, "My name X is tied to my signing key
K" and is corroborated by other users' certifications. If another
user revokes their certification, they are effectively saying that
they no longer believe that name and that key are tied together.
Similarly, if the users themselves revoke their self-signature, then
the users no longer go by that name, no longer have that email
address, etc. Revoking a binding signature effectively retires that
subkey. Revoking a direct-key signature cancels that signature.
Please see the "Reason for Revocation" subpacket (Section 22.214.171.124)
for more relevant detail.
Since a self-signature contains important information about the key's
use, an implementation SHOULD allow the user to rewrite the self-
signature, and important information in it, such as preferences and
It is good practice to verify that a self-signature imported into an
implementation doesn't advertise features that the implementation
doesn't support, rewriting the signature as appropriate.
An implementation that encounters multiple self-signatures on the
same object may resolve the ambiguity in any way it sees fit, but it
is RECOMMENDED that priority be given to the most recent self-
126.96.36.199. Signature Creation Time
(4-octet time field)
The time the signature was made.
MUST be present in the hashed area.
(8-octet Key ID)
The OpenPGP Key ID of the key issuing the signature.
188.8.131.52. Key Expiration Time
(4-octet time field)
The validity period of the key. This is the number of seconds after
the key creation time that the key expires. If this is not present
or has a value of zero, the key never expires. This is found only on
184.108.40.206. Preferred Symmetric Algorithms
(array of one-octet values)
Symmetric algorithm numbers that indicate which algorithms the key
holder prefers to use. The subpacket body is an ordered list of
octets with the most preferred listed first. It is assumed that only
algorithms listed are supported by the recipient's software.
Algorithm numbers are in Section 9. This is only found on a self-
220.127.116.11. Preferred Hash Algorithms
(array of one-octet values)
Message digest algorithm numbers that indicate which algorithms the
key holder prefers to receive. Like the preferred symmetric
algorithms, the list is ordered. Algorithm numbers are in Section 9.
This is only found on a self-signature.
18.104.22.168. Preferred Compression Algorithms
(array of one-octet values)
Compression algorithm numbers that indicate which algorithms the key
holder prefers to use. Like the preferred symmetric algorithms, the
list is ordered. Algorithm numbers are in Section 9. If this
subpacket is not included, ZIP is preferred. A zero denotes that
uncompressed data is preferred; the key holder's software might have
no compression software in that implementation. This is only found
on a self-signature.
22.214.171.124. Signature Expiration Time
(4-octet time field)
The validity period of the signature. This is the number of seconds
after the signature creation time that the signature expires. If
this is not present or has a value of zero, it never expires.
126.96.36.199. Exportable Certification
(1 octet of exportability, 0 for not, 1 for exportable)
This subpacket denotes whether a certification signature is
"exportable", to be used by other users than the signature's issuer.
The packet body contains a Boolean flag indicating whether the
signature is exportable. If this packet is not present, the
certification is exportable; it is equivalent to a flag containing a
Non-exportable, or "local", certifications are signatures made by a
user to mark a key as valid within that user's implementation only.
Thus, when an implementation prepares a user's copy of a key for
transport to another user (this is the process of "exporting" the
key), any local certification signatures are deleted from the key.
The receiver of a transported key "imports" it, and likewise trims
any local certifications. In normal operation, there won't be any,
assuming the import is performed on an exported key. However, there
are instances where this can reasonably happen. For example, if an
implementation allows keys to be imported from a key database in
addition to an exported key, then this situation can arise.
Some implementations do not represent the interest of a single user
(for example, a key server). Such implementations always trim local
certifications from any key they handle.
(1 octet of revocability, 0 for not, 1 for revocable)
Signature's revocability status. The packet body contains a Boolean
flag indicating whether the signature is revocable. Signatures that
are not revocable have any later revocation signatures ignored. They
represent a commitment by the signer that he cannot revoke his
signature for the life of his key. If this packet is not present,
the signature is revocable.
188.8.131.52. Trust Signature
(1 octet "level" (depth), 1 octet of trust amount)
Signer asserts that the key is not only valid but also trustworthy at
the specified level. Level 0 has the same meaning as an ordinary
validity signature. Level 1 means that the signed key is asserted to
be a valid trusted introducer, with the 2nd octet of the body
specifying the degree of trust. Level 2 means that the signed key is
asserted to be trusted to issue level 1 trust signatures, i.e., that
it is a "meta introducer". Generally, a level n trust signature
asserts that a key is trusted to issue level n-1 trust signatures.
The trust amount is in a range from 0-255, interpreted such that
values less than 120 indicate partial trust and values of 120 or
greater indicate complete trust. Implementations SHOULD emit values
of 60 for partial trust and 120 for complete trust.
184.108.40.206. Regular Expression
(null-terminated regular expression)
Used in conjunction with trust Signature packets (of level > 0) to
limit the scope of trust that is extended. Only signatures by the
target key on User IDs that match the regular expression in the body
of this packet have trust extended by the trust Signature subpacket.
The regular expression uses the same syntax as the Henry Spencer's
"almost public domain" regular expression [REGEX] package. A
description of the syntax is found in Section 8 below.
220.127.116.11. Revocation Key
(1 octet of class, 1 octet of public-key algorithm ID, 20 octets of
Authorizes the specified key to issue revocation signatures for this
key. Class octet must have bit 0x80 set. If the bit 0x40 is set,
then this means that the revocation information is sensitive. Other
bits are for future expansion to other kinds of authorizations. This
is found on a self-signature.
If the "sensitive" flag is set, the keyholder feels this subpacket
contains private trust information that describes a real-world
sensitive relationship. If this flag is set, implementations SHOULD
NOT export this signature to other users except in cases where the
data needs to be available: when the signature is being sent to the
designated revoker, or when it is accompanied by a revocation
signature from that revoker. Note that it may be appropriate to
isolate this subpacket within a separate signature so that it is not
combined with other subpackets that need to be exported.
18.104.22.168. Notation Data
(4 octets of flags, 2 octets of name length (M),
2 octets of value length (N),
M octets of name data,
N octets of value data)
This subpacket describes a "notation" on the signature that the
issuer wishes to make. The notation has a name and a value, each of
which are strings of octets. There may be more than one notation in
a signature. Notations can be used for any extension the issuer of
the signature cares to make. The "flags" field holds four octets of
All undefined flags MUST be zero. Defined flags are as follows:
First octet: 0x80 = human-readable. This note value is text.
Other octets: none.
Notation names are arbitrary strings encoded in UTF-8. They reside
in two namespaces: The IETF namespace and the user namespace.
The IETF namespace is registered with IANA. These names MUST NOT
contain the "@" character (0x40). This is a tag for the user
Names in the user namespace consist of a UTF-8 string tag followed by
"@" followed by a DNS domain name. Note that the tag MUST NOT
contain an "@" character. For example, the "sample" tag used by
Example Corporation could be "email@example.com".
Names in a user space are owned and controlled by the owners of that
domain. Obviously, it's bad form to create a new name in a DNS space
that you don't own.
Since the user namespace is in the form of an email address,
implementers MAY wish to arrange for that address to reach a person
who can be consulted about the use of the named tag. Note that due
to UTF-8 encoding, not all valid user space name tags are valid email
If there is a critical notation, the criticality applies to that
specific notation and not to notations in general.
22.214.171.124. Key Server Preferences
(N octets of flags)
This is a list of one-bit flags that indicate preferences that the
key holder has about how the key is handled on a key server. All
undefined flags MUST be zero.
First octet: 0x80 = No-modify
the key holder requests that this key only be modified or updated
by the key holder or an administrator of the key server.
This is found only on a self-signature.
126.96.36.199. Preferred Key Server
This is a URI of a key server that the key holder prefers be used for
updates. Note that keys with multiple User IDs can have a preferred
key server for each User ID. Note also that since this is a URI, the
key server can actually be a copy of the key retrieved by ftp, http,
188.8.131.52. Primary User ID
(1 octet, Boolean)
This is a flag in a User ID's self-signature that states whether this
User ID is the main User ID for this key. It is reasonable for an
implementation to resolve ambiguities in preferences, etc. by
referring to the primary User ID. If this flag is absent, its value
is zero. If more than one User ID in a key is marked as primary, the
implementation may resolve the ambiguity in any way it sees fit, but
it is RECOMMENDED that priority be given to the User ID with the most
When appearing on a self-signature on a User ID packet, this
subpacket applies only to User ID packets. When appearing on a
self-signature on a User Attribute packet, this subpacket applies
only to User Attribute packets. That is to say, there are two
different and independent "primaries" -- one for User IDs, and one
for User Attributes.
184.108.40.206. Policy URI
This subpacket contains a URI of a document that describes the policy
under which the signature was issued.
220.127.116.11. Key Flags
(N octets of flags)
This subpacket contains a list of binary flags that hold information
about a key. It is a string of octets, and an implementation MUST
NOT assume a fixed size. This is so it can grow over time. If a
list is shorter than an implementation expects, the unstated flags
are considered to be zero. The defined flags are as follows:
0x01 - This key may be used to certify other keys.
0x02 - This key may be used to sign data.
0x04 - This key may be used to encrypt communications.
0x08 - This key may be used to encrypt storage.
0x10 - The private component of this key may have been split
by a secret-sharing mechanism.
0x20 - This key may be used for authentication.
0x80 - The private component of this key may be in the
possession of more than one person.
The flags in this packet may appear in self-signatures or in
certification signatures. They mean different things depending on
who is making the statement -- for example, a certification signature
that has the "sign data" flag is stating that the certification is
for that use. On the other hand, the "communications encryption"
flag in a self-signature is stating a preference that a given key be
used for communications. Note however, that it is a thorny issue to
determine what is "communications" and what is "storage". This
decision is left wholly up to the implementation; the authors of this
document do not claim any special wisdom on the issue and realize
that accepted opinion may change.
The "split key" (0x10) and "group key" (0x80) flags are placed on a
self-signature only; they are meaningless on a certification
signature. They SHOULD be placed only on a direct-key signature
(type 0x1F) or a subkey signature (type 0x18), one that refers to the
key the flag applies to.
18.104.22.168. Signer's User ID
This subpacket allows a keyholder to state which User ID is
responsible for the signing. Many keyholders use a single key for
different purposes, such as business communications as well as
personal communications. This subpacket allows such a keyholder to
state which of their roles is making a signature.
This subpacket is not appropriate to use to refer to a User Attribute
22.214.171.124. Reason for Revocation
(1 octet of revocation code, N octets of reason string)
This subpacket is used only in key revocation and certification
revocation signatures. It describes the reason why the key or
certificate was revoked.
The first octet contains a machine-readable code that denotes the
reason for the revocation:
0 - No reason specified (key revocations or cert revocations)
1 - Key is superseded (key revocations)
2 - Key material has been compromised (key revocations)
3 - Key is retired and no longer used (key revocations)
32 - User ID information is no longer valid (cert revocations)
100-110 - Private Use
Following the revocation code is a string of octets that gives
information about the Reason for Revocation in human-readable form
(UTF-8). The string may be null, that is, of zero length. The
length of the subpacket is the length of the reason string plus one.
An implementation SHOULD implement this subpacket, include it in all
revocation signatures, and interpret revocations appropriately.
There are important semantic differences between the reasons, and
there are thus important reasons for revoking signatures.
If a key has been revoked because of a compromise, all signatures
created by that key are suspect. However, if it was merely
superseded or retired, old signatures are still valid. If the
revoked signature is the self-signature for certifying a User ID, a
revocation denotes that that user name is no longer in use. Such a
revocation SHOULD include a 0x20 code.
Note that any signature may be revoked, including a certification on
some other person's key. There are many good reasons for revoking a
certification signature, such as the case where the keyholder leaves
the employ of a business with an email address. A revoked
certification is no longer a part of validity calculations.
(N octets of flags)
The Features subpacket denotes which advanced OpenPGP features a
user's implementation supports. This is so that as features are
added to OpenPGP that cannot be backwards-compatible, a user can
state that they can use that feature. The flags are single bits that
indicate that a given feature is supported.
This subpacket is similar to a preferences subpacket, and only
appears in a self-signature.
An implementation SHOULD NOT use a feature listed when sending to a
user who does not state that they can use it.
Defined features are as follows:
0x01 - Modification Detection (packets 18 and 19)
If an implementation implements any of the defined features, it
SHOULD implement the Features subpacket, too.
An implementation may freely infer features from other suitable
126.96.36.199. Signature Target
(1 octet public-key algorithm, 1 octet hash algorithm, N octets hash)
This subpacket identifies a specific target signature to which a
signature refers. For revocation signatures, this subpacket
provides explicit designation of which signature is being revoked.
For a third-party or timestamp signature, this designates what
signature is signed. All arguments are an identifier of that target
The N octets of hash data MUST be the size of the hash of the
signature. For example, a target signature with a SHA-1 hash MUST
have 20 octets of hash data.
188.8.131.52. Embedded Signature
(1 signature packet body)
This subpacket contains a complete Signature packet body as
specified in Section 5.2 above. It is useful when one signature
needs to refer to, or be incorporated in, another signature.
5.2.4. Computing Signatures
All signatures are formed by producing a hash over the signature
data, and then using the resulting hash in the signature algorithm.
For binary document signatures (type 0x00), the document data is
hashed directly. For text document signatures (type 0x01), the
document is canonicalized by converting line endings to <CR><LF>,
and the resulting data is hashed.
When a signature is made over a key, the hash data starts with the
octet 0x99, followed by a two-octet length of the key, and then body
of the key packet. (Note that this is an old-style packet header for
a key packet with two-octet length.) A subkey binding signature
(type 0x18) or primary key binding signature (type 0x19) then hashes
the subkey using the same format as the main key (also using 0x99 as
the first octet). Key revocation signatures (types 0x20 and 0x28)
hash only the key being revoked.
A certification signature (type 0x10 through 0x13) hashes the User
ID being bound to the key into the hash context after the above
data. A V3 certification hashes the contents of the User ID or
attribute packet packet, without any header. A V4 certification
hashes the constant 0xB4 for User ID certifications or the constant
0xD1 for User Attribute certifications, followed by a four-octet
number giving the length of the User ID or User Attribute data, and
then the User ID or User Attribute data.
When a signature is made over a Signature packet (type 0x50), the
hash data starts with the octet 0x88, followed by the four-octet
length of the signature, and then the body of the Signature packet.
(Note that this is an old-style packet header for a Signature packet
with the length-of-length set to zero.) The unhashed subpacket data
of the Signature packet being hashed is not included in the hash, and
the unhashed subpacket data length value is set to zero.
Once the data body is hashed, then a trailer is hashed. A V3
signature hashes five octets of the packet body, starting from the
signature type field. This data is the signature type, followed by
the four-octet signature time. A V4 signature hashes the packet body
starting from its first field, the version number, through the end
of the hashed subpacket data. Thus, the fields hashed are the
signature version, the signature type, the public-key algorithm, the
hash algorithm, the hashed subpacket length, and the hashed
V4 signatures also hash in a final trailer of six octets: the
version of the Signature packet, i.e., 0x04; 0xFF; and a four-octet,
big-endian number that is the length of the hashed data from the
Signature packet (note that this number does not include these final
After all this has been hashed in a single hash context, the
resulting hash field is used in the signature algorithm and placed
at the end of the Signature packet.
184.108.40.206. Subpacket Hints
It is certainly possible for a signature to contain conflicting
information in subpackets. For example, a signature may contain
multiple copies of a preference or multiple expiration times. In
most cases, an implementation SHOULD use the last subpacket in the
signature, but MAY use any conflict resolution scheme that makes
more sense. Please note that we are intentionally leaving conflict
resolution to the implementer; most conflicts are simply syntax
errors, and the wishy-washy language here allows a receiver to be
generous in what they accept, while putting pressure on a creator to
be stingy in what they generate.
Some apparent conflicts may actually make sense -- for example,
suppose a keyholder has a V3 key and a V4 key that share the same
RSA key material. Either of these keys can verify a signature
created by the other, and it may be reasonable for a signature to
contain an issuer subpacket for each key, as a way of explicitly
tying those keys to the signature.