[Openpgp-dt] 2022-05-03 design team meeting notes

[Stephen Farrell <[e-mail]>]

# OpenPGP Design Team Meeting

2022-05-03

Present:
dkg
Justus
Stephen
Daniel Huigens
Jeffrey

# Agenda:

     - new TB release & sha-1: see discussion on WG list
       TODO: jeffrey to see whether RNP offers time-limited algorithm 
acceptance; if so, suggest the change to TB.

## Open MRs

- We have a pile with 1 approver (and a good few with more), we got to 
 >1 approver on 'em

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/178
- needs some rebase/merge magic
- now has >1 approver

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/177
- now has >1 approver

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/176
- now has >1 approver

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/175
- now has >1 approver
- lots of trivial changes so might create merge conflicts

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/171
- now has >1 approver

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/169
- now has >1 approver

## https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/155
- now has >1 approver

## Outstanding issues

## https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/111
- seems like a good plan, needs someone to do it
- if nobody gets to it we can live with that
- add a "nice-to-have" label

## https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/52
- whether to document what's currenly a hacky/proprietary way to export 
mixtures of public and private key materials
- conclusion is to gather more feedback before trying for an MR
- TODO: dkg will check with gniibe, jeffrey will check in locally

## https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/95
- TODO: dkg to send to wg list about this
- text in draft already covers this but wanted to check

## https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/42
- danielh: this can be closed

## https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/103
- same as the two above really, but with a bit still to be merged to 
close this one

## https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/64
- dkg: if we do something like this, maybe include public key and not a FP
- sftcd: is this something that could be separated out? if so would that 
be a plan? (answers: yes & dunno)
- mark as nice-to-have

## Misc.

- still an action on SF from ietf113 meeting
- possible compression bombs - is that handled somewhere? there's a test 
vector in Justus' repo
TODO: dkg to open an issue (point to compression bomb in sequoia)
- limits on numbers of signatures (ABNF recursion?), embedded signatures.
TODO: dkg to open an issue

- huigens points out that v5 revocation certificate does not have a 
direct-key signature, which would make it difficult to distribute 
designated revoker mechanism (as that mechanism would live on the 
direct-key signature)

- getting finished:
- sftcd try arrange more meeting slots next week - send poll
- sftcd to check with paul on merges