Keep corruption and cryptographic input separate
05Changing trailing spaces can change what a flowed reader displays. Cryptographic processing must use the agreed wire representation.
The protected wire representation follows a separate path to cryptographic processing. The reflowed display is a different representation and is stopped from being substituted as input. No verification result is claimed.
Source for this drawing: RFC 3676 · Read RFC section 7.1 ↗
New to this? Start hereA quick picture + helpful background
The envelope and the letter do different jobs.
Mail transport moves a message between servers. The message format describes its contents. Authentication adds checks; it does not make every message safe.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The displayed paragraph is not the cryptographic input.
- Stripping trailing spaces turns flowed lines into fixed lines. Adding trailing spaces can produce malformed display or replies by making hard boundaries look soft.
- Signing, verification, encryption and decryption need consistent on-the-wire text. Reflowing display text must not silently replace that cryptographic input.
- Section4.6 strongly discourages the referenced cleartext OpenPGP format with flowed messages and recommends OpenPGP-MIME instead: ignored trailing whitespace can allow changed rendering without detection. This is scoped historical guidance, not a complete current cryptographic profile.
The drawings illustrate transformations and boundaries, not an actual signature, key, encryption operation or successful authentication. Ordinary text/plain security considerations still apply. Section10 cautions that flowed quoting/wrapping may be unsuitable for some right-to-left charsets; fixed text with suitable transfer encoding may fit better. This small guide is not a Unicode line-breaking engine, MIME decoder, mail client or security implementation.
Read the RFC section ↗