[openpgp] Signatures with in-band subkeys

[Julian Andres Klode <[e-mail]>]

Hi OpenPGP folks!

as some of you know I maintain APT, the Debian/Ubuntu package
manager.

One topic of concern for package management is the ability to
have online signing keys and an offline primary key that they
are chained too, as you want your repositories to work automatically.

I've been drafting a new signing scheme for APT repositories
a couple years back that hasn't been implemented, so far at
least, we are still using OpenPGP.

Now one of the ideas there is that instead of having to know
the online subkey a-priori, we instead ship the online subkey
alongside the signature.

In case your online subkey gets compromised you can just create
a new subkey and sign your data with that and the client trusts
it.

I also added a generation number: We only trust a new subkey
if its generation is higher. This means that once a client
sees a signature from a new in-band subkey, it won't ever
trust a previous in-band subkey again.

You can have multiple subkeys with the same generation on
a technical level, which is why I did not call it a serial
number.

This works reasonably well for the native apt-sign scheme:

1. We read the previous signed metadata and get a list of 
   (primary key id, generation)
2. We read the new signed metadata and check that the subkeys
   in there are >= the generation in the old one

Alternative means are to keep the mapping in a global state file.

I'm curious to hear if this is something of interest to the
OpenPGP community.
-- 
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer                              i speak de, en