Re: [openpgp] To bind or not to bind

[Justus Winter <[e-mail]>]

Hi,

for completeness, here is my preference:

Aron Wussler <[e-mail]> writes:

> Here's the follow-up on the dilemma we had at the IETF 119 session, whether PQC encryption should be bound to V6 or allowed with V4.
>
> Note that this translates into two different issues:
>
>  (1) Whether PQC encryption algorithms can be used only in v6 keys

Yes, do bind PQC to v6 keys:

- Move to PQC is either intrinsically motivated or a regulatory
  requirement.  Moving to v6 OpenPGP doesn't have the same advantage, so
  let's leverage the motivation to move to PQC to get v6 adopted
  quickly.

- v4 OpenPGP implementations are not robust enough to handle unknown
  subkeys.  Adding PQC encryption subkeys to v4 certificates is not a
  viable opportunistic upgrade path, but a way to make your existing
  certificate unusable:

  https://tests.sequoia-pgp.org/#Mock_PQ_subkey

- There is precedent for restricting algorithms to certain packet
  versions:

  https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-13.html#section-9.2-6

>  (2) Whether PQC encryption algorithms can be used only with SEIPDv2

No, don't bind PQC encryption to SEIPDv2.  It should be possible to have
a "PKESKv3(classical) PKESKv6(PQC) SEIPDv1" message:

- In contrast to adding subkeys with unknown algorithms, this kind of
  message is well supported:

  https://tests.sequoia-pgp.org/#Messages_with_unknown_packets

Best,
Justus