[openpgp] Re: Primary Key Binding sigs on authentication subkeys

[Daniel Huigens <[e-mail]>]

Hi Andrew & all,

Thanks for raising this! In the interest of maybe moving this discussion
forward I'll repeat (more or less) what I wrote in the issue :)

Section 2.2 of the spec [1] talks about how to do authentication using
signatures. Therefore, it seems like authentication subkeys should be
included in the category of "subkeys that can issue signatures".

I'm not sure if there's any plausible attack possible when omitting the
backsig check; the only thing I can think of is if you (for some reason)
whitelist the issuer (sub)key fingerprint, and then trust the primary
key & e.g. display the User ID (of the person that supposedly has
authenticated) based on that, which would admittedly be a strange thing
to do, though the spec text might lead you to believe that this would
be sound.

Also, I'm not sure whether anyone actually does authentication via
signatures, or whether it's really a great idea. Nevertheless, since
the spec allows it it seems reasonable to make sure that _if_ anyone
does it, it's indeed secure.

But, if existing keys don't have this backsig, then I suppose we indeed
can't enforce it there. So I would be fine with checking the backsig for
v6 keys only, for example.

---

For what it's worth, our libraries don't really meaningfully support
authentication (sub)keys beyond reading and verifying them; you can't
generate or use them to sign/verify anything, at the moment.

So, unless folks think it's worth changing that, we could also consider
deprecating authentication subkeys entirely, and say that an application
that (for some reason) wants to do authentication using OpenPGP, should
use a dedicated key/certificate, and just use a normal signing (sub)key?

Best,
Daniel

[1]: https://www.rfc-editor.org/rfc/rfc9580.html#name-authentication-via-digital-