Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
What is the purpose of the --sig-notation and --cert-notation options in GnuPG? What are the intended use cases?
In the first part the a @ character is used, so I guess the options are for providing certain e-mail addresses. But which email address should be given?
Notations provide meanings to add information to a signature or certification (which also is a special kind of signature). From RFC 4880, 5.2.3.16. Notation Data:
This subpacket describes a "notation" on the signature that the issuer wishes to make. The notation has a name and a value, each of which are strings of octets. There may be more than one notation in a signature. Notations can be used for any extension the issuer of the signature cares to make. [...]
Notations are rarely used in practice (actually I've never seen real usage, although there are few notation subpackets to be found in key server dumps). Example usage might be to add the location of an identity check during key signing, or the document types presented.
Each notation consists of a notation name and a value, while the value is an arbitrary UTF-8 encoded string.
Regarding the @, this is part of the notation namespaces. Namespaces help to distinguish notations if they use the same name, but are defined by different people. Again from the same section of the RFC:
Notation names are arbitrary strings encoded in UTF-8. They reside in two namespaces: The IETF namespace and the user namespace.
The IETF namespace is registered with IANA. These names MUST NOT contain the "@" character (0x40). This is a tag for the user namespace.
Names in the user namespace consist of a UTF-8 string tag followed by "@" followed by a DNS domain name. Note that the tag MUST NOT contain an "@" character. For example, the "sample" tag used by Example Corporation could be "sample@example.com".
Names in a user space are owned and controlled by the owners of that domain. Obviously, it's bad form to create a new name in a DNS space that you don't own.
Since the user namespace is in the form of an email address, implementers MAY wish to arrange for that address to reach a person who can be consulted about the use of the named tag. Note that due to UTF-8 encoding, not all valid user space name tags are valid email addresses.
With other words, there can be official notations in the form of some-notation-name defined by a standard and registered with the IANA. On the other hand, everybody can declare his own notations, which should have the form my-notation-name@example.com. For example, if I would use some-notation-name@jenserat.de, it would not collide with the (assumed) official notation some-notation-name in the IANA namespace.
