Re: [openpgp] To bind or not to bind

[Daniel Kahn Gillmor <[e-mail]>]

Thanks for asking this question, Aron.

With no hats on, here are my preferences:

On Thu 2024-03-21 20:26:26 +0000, Aron Wussler wrote:

>  (1) Whether PQC encryption algorithms can be used only in v6 keys

I am still undecided on (1).

>  (2) Whether PQC encryption algorithms can be used only with SEIPDv2

I think the answer here should be: "PQC encryption-capable subkeys MAY
be used with SEIPDv1 when encrypting a single message to multiple
parties, and some of the recipient parties do not support SEIPDv2".

I would not object to a statement like "Binding a PQC encryption-capable
subkey into a certificate implies setting Feature Flag 0x08 (SEIPDv2
support)".  We basically already require implementations to impute
Feature Flag 0x01 (SEIPDv1 support) even if it is not explicitly set,
because SED encryption needs to go away.  And an implementation that can
implement PQC but is incapable of implementing SEIPDv2 would be very
surprising.  Why not couple them explicitly to move users to the more
robust format?

OTOH, I would *not* want to introduce a new failure mode for a case
where i can encrypt to two distinct certs individually, but i cannot
encrypt to the two of them together.  That strikes me as terribly
unfriendly to the application layer.  Does anyone think that would be an
acceptable outcome?

   --dkg