Early testing of the multi-signature feature (done by @Jakuje and the team) has revealed some possible issues/bugs related the overall verification result when one or more signature is faulty, namely:
- Corrupted signatures (inverted byte in the middle of the signature area) currently do not cause the whole verification to fail if there is another signature that is OK
- Signatures done by algorithms forbidden in crypto-policies currently do cause the whole verification to fail, even if there is another signature that is OK
It seems like these two cases should actually result in the exact opposites, i.e. the former (a corrupt signature) should result in a negative verification whereas the latter (a forbidden or disabled algo) should result in a positive one. This is especially true in the context of the original requirements captured in #3385, which says:
verification will:
- ignore unknown algorithms
- require all known (and enabled) signatures to pass for a positive verification