Re: [openpgp] Call for adoption of draft-gallagher-openpgp-replacementkey

[Simon Josefsson <[e-mail]>]

Daniel Kahn Gillmor <[e-mail]> writes:

> On Sun 2024-04-07 10:32:32 +0200, Simon Josefsson wrote:
>> If automatic processing is intended, I think readers should come away
>> with some understanding of how that automatic processing is intended to
>> be implemented given a key that has 0, 1, 2 and 300.000 replacementkey
>> subpackets.
>
> I agree that this draft would be significantly more useful if it
> described some explicit processing steps and gave implementers guidance
> about how to expect processing to happen.
>
> Incorporating some of the motivating text from Andrew into the
> introduction would also be useful.
>
> Andrew, Daphne, do you think the draft could accomodate those kinds of
> additions if the working group were to adopt it?
>
> Simon, would you be up for proposing some of this text if the working
> group were to adopt?

I have a hard time understanding what problem the document sets out to
solve, so it feels challenging to contribute other than asking to make
the problem statement clear.  Is this intended to replace or augment
human-written key transition statements?  Doing so would be useful, and
quite important to ease key roll-over to PQC keys, but transition
statements are usually not published when keys are expired or revoked.
So it is not clear to me what this document actually achieves, or even
wants to achieve.

/Simon

> it doesn't need to be perfect initially, or to cover every possible use
> case, but having some initial description of a common use case when
> consuming these signals would i think motivate both readers and
> implementers to think through how to make the thing effective.  It would
> also probably help trigger some discussions about how it could
> potentially be abused, and maybe the WG can build in some mitigations
> once the potential abuses are clearer.
>
>             --dkg
>
> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp
>