Re: [openpgp] To bind or not to bind

[Daniel Huigens <[e-mail]>]

On Friday, March 22nd, 2024 at 19:51, Andrew Gallagher wrote:
> Is it possible to update this test with the optional flag that Falko mentioned, to see if it improves RNP’s score on line 3? If it does, I’d argue that this is no longer fatal - gopenpgp v2 has been superseded already, and pgpy is fairly niche.

Do applications using rnp (e.g. Thunderbird) use this flag, though?
If not, I'd argue the test result is still relevant, but perhaps
applications could be updated to use the flag (and/or rnp could be
updated to change the default, of course).

Btw, GopenPGP v3 is not released yet, but we'll do so soon(tm).

FWIW, there is another potential interop problem, around PKESKs with
unknown algorithms [1]. PGPainless and PGPy fail to parse those.
Hopefully that can be fixed as well, but for the time being, it means
that if you want 100% interoperability, you might have to send two
separate messages anyway.

However, if we allow using PQC with SEIPDv1, you could still encrypt
once and then just split the PKESKs, and reuse the SEIPDv1 packet, so
that's something at least.

Best,
Daniel

[1]: https://tests.sequoia-pgp.org/#Messages_with_unknown_packets