[openpgp] preferences on the direct-key signature

["Neal H. Walfield" <[e-mail]>]

> 5.2.3.7.  Notes on Self-Signatures
>
>    For version 5 keys, it is RECOMMENDED to store information about the
>    primary Public-Key as well as the Transferable Public Key as a whole
>    (key flags, key expiration, features, algorithm preferences, etc.) in
>    a direct-key signature (type 0x1F) over the Public-Key instead of
>    placing that information in a User ID self-signature.  An
>    implementation MUST ensure that a valid direct-key signature is
>    present before using a v5 key.  This prevents certain attacks where
>    an adversary strips a self-signature specifying a key expiration time
>    or certain preferences.

I'm a bit confused by this advice.  From what I understand: a v5 key
MUST have a direct-key signature, but it is only RECOMMENDED to store,
e.g., the key expiration subpacket there.  In that case, how does that
"prevent certain attacks where an adversary strips a self-signature
specifying a key expiration time or certain preferences"?  If the
preferences are stored on a User ID self-signature, then they can
still be stripped.  Or what am I misunderstanding?

>   Implementing software should interpret a self-signature's preference
>   subpackets as narrowly as possible.  For example, suppose a key has
>   two user names, Alice and Bob. Suppose that Alice prefers the AEAD
>   ciphersuite AES-256 with OCB, and Bob prefers Camellia-256 with GCM.
>   If the software locates this key via Alice's name, then the preferred
>   AEAD ciphersuite is AES-256 with OCB; if software locates the key via
>   Bob's name, then the preferred algorithm is Camellia-256 with GCM.
>   If the key is located by Key ID, the algorithm of the primary User ID
>   of the key provides the preferred AEAD ciphersuite.

This advice doesn't consider preferences stored on the direct-key
signature.  Perhaps the order should be:

  - Optionally specified User ID
  - Primary User ID
  - Direct Key Signature


I'm a bit worried about the key expiration subpacket, as different
implementations may update it in different ways.  For instance,
Sequoia stores the key expiration on the direct key signature and in
the User ID self signatures.  When trying to change such a key using
GnuPG, GnuPG only updates the key expiration subpacket on the User ID.
See this issue for more details:

  https://gitlab.com/sequoia-pgp/sequoia/-/issues/926

I think it would be good to say that for v5 keys, the direct-key
signature is the only source of truth for this type of information
(specifically, the key expiration and key flags subpackets).

Neal