Re: draft-ietf-openpgp-rfc2440bis-06.txt

[David Shaw <[e-mail]>]

On Tue, Sep 24, 2002 at 02:53:23PM -0400, Michael Young wrote:

> A moment ago, I agreed with Jon's assertion that:
> > >Key expirations are not "my" system. They're the way the OpenPGP works. If
> > I agree with Jon's analysis.  Certainly, key expirations as they
> > are defined now are rewriteable.  His example (periodically
> 
> Sigh.  Perhaps I shouldn't have been quite so quick to agree.
> The last few drafts have included language on rewriting self-signatures,
> but I can't find any in the "original" (http://www.ietf.org/rfc/rfc2440.txt).
> This makes it a little hard to assert that this is just "how OpenPGP works".
> 
> BUT... this is "how GnuPG works" with respect to the act of
> rewriting, and it may just be "how PGP and GnuPG work" with
> respect to interpreting multiple expiration times.
> 
> Bodo an David have proposed using the key-expiration[9] and
> (self-)signature-expiration[3] subpackets as "hard" and "soft"
> flavors.  One could implement Jon's "rolling expiration"
> scenarios with the self-signatures.

Whoah - I am not proposing that.  My comments were in the context of
how a potential v5 key format could work (and as a side note on how
GnuPG handles a v3 key with a v4 selfsig).  That's all.  As I see it,
without an expiration date *in the key packet*, there is no true
"hard" expiration date.  I agree with Jon's analysis.

> Alas, neither PGP(6.5) nor GnuPG(1.0.6) generates a signature-
> expiration[3] subpacket.  GnuPG's expiration-changing function
> operates on the key-expiration[9] subpacket.

GnuPG 1.0.6 is fairly old now.  More recent versions allow the
(determined) user to generate themselves an expiring self-signature
(via subpacket 3).  When that self-signature expires, the user ID it
binds (not the key) becomes invalid.  Of course, you then end up with
a key with no valid user IDs.  This is as per 5.2.3.3. "Notes on
Self-Signatures" in bis-06.

David

-- 
   David Shaw  |  [e-mail]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson