Re: Resolving multiple primary user IDs and self-signatures

[David Shaw <[e-mail]>]

On Sat, Aug 25, 2001 at 01:11:52PM +0200, Florian Weimer wrote:
> 
> David Shaw <[e-mail]> writes:
> 
> > Here are two suggestions to help with resolving multiple user IDs
> > marked primary, as well as resolving multiple self-signatures with
> > different subpackets:
> 
> This should probably go into a separate RFC.  Currently, RFC 2440 and
> RFC 2440bis deal only with syntactic issues (apart from a minor glitch
> in RFC 2440bis, 'A revoked certification no longer is a part of
> validity calculations.').

True, and it even says that in the Abstract.  There is an exception
made for security issues: "It does not deal with storage and
implementation questions.  It does, however, discuss implementation
issues necessary to avoid security flaws."

Offhand, I can't think of a security implication to having multiple
UIDs marked primary (though I'm sure someone here can).  My concern is
with the security implications of having multiple conflicting
self-signatures.  Without some suggested way to resolve the conflict,
there can be security implications.  If it is truly a security issue,
then it is appropriate in 2440bis.  (Obviously, I think it's enough of
a security issue to mention - I'd like to hear what others think.)

Self-signatures can carry subpackets that definitely affect the
actions that may be taken with a key.  To use one of my examples from
last night, if/when a symmetric cipher or hash is broken, the user can
simply announce that cipher or hash is not accepted (via a "preferred
symmetric algorithms" or "preferred hash algorithms" subpacket).
Without a way to resolve which self-signature is the one to follow,
the broken cipher or hash may be used, which could compromise the
security of the message.

> On the other hand, If such additions are accepted, I've got a long
> list of them...

Care to work on a "Implementation Suggestions for OpenPGP" with me?

David

-- 
David Shaw          |  Technical Lead
<[e-mail]>  |  Enterprise Content Delivery
617-250-3028        |  Akamai Technologies