Re: [openpgp] primary key binding signature requirement

[Paul Schaub <[e-mail]>]

Hey!

If we add a section about certification capable subkeys, I would like to see them forbidden.

The protocol is complex enough as it is today. I believe there are no use-cases that require subkeys of subkeys which cannot be solved in other ways.

Paul

Am 2. Dezember 2022 23:38:05 MEZ schrieb Aron Wussler <[e-mail]>:
>Hi Neal,
>
>> if a subkey binding signature includes the Key Flags subpacket and
>> the certification capability (0x1) or the signing capability (0x2)
>> is set, then the subkey binding signature must also contain a valid
>> primary key binding signature issued by the subkey over the primary
>> key.
>
>I agree with this.
>
>As a side note, I don't know whether we should allow subkeys to issue certifications.
>
>In real life I found poor support for subkeys with certification capability. I found no real way to create such keys (without messing with them manually) and other implementations didn't understand certifications made from that key.
>
>Maybe we should either forbid that entirely or explicitly support it.
>
>Cheers,
>Aron
>
>
>--
>Aron Wussler
>Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930
>
>
>
>------- Original Message -------
>On Thursday, December 1st, 2022 at 10:33, Neal H. Walfield <[e-mail]> wrote:
>
>
>> Section 11.1.1 Common requirements says:
>> 
>
>> Each Subkey packet MUST be followed by one Signature packet, which
>> should be a subkey binding signature issued by the top-level key.
>> For subkeys that can issue signatures, the subkey binding signature
>> MUST contain an Embedded Signature subpacket with a primary key
>> binding signature (0x19) issued by the subkey on the top-level key.
>> 
>
>> https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-07#section-11.1.4
>> 
>
>> What does it mean for a subkey to issue signatures? I think
>> authentication subkeys technically issue signatures, but they don't
>> normally include a primary key binding signature. For instance,
>> here's the `sq packet dump` output for an authentication-capable
>> subkey created using gpg 2.2.27:
>> 
>
>> Public-Subkey Packet, old CTB, 397 bytes
>> Version: 4
>> Creation time: 2022-12-01 09:26:21 UTC
>> Pk algo: RSA
>> Pk size: 3072 bits
>> Fingerprint: 136ABFA01DD47269514F757B10F4A631F1CB5D14
>> KeyID: 10F4A631F1CB5D14
>> 
>
>> Signature Packet, old CTB, 438 bytes
>> Version: 4
>> Type: SubkeyBinding
>> Pk algo: RSA
>> Hash algo: SHA512
>> Hashed area:
>> Issuer Fingerprint: 188A993D54814E76FF988779E962990F14D5ACA4
>> Signature creation time: 2022-12-01 09:26:21 UTC
>> Key flags: A
>> Unhashed area:
>> Issuer: E962990F14D5ACA4
>> Digest prefix: 3C63
>> Level: 0 (signature over data)
>> 
>
>> Should authentication-capable subkeys include a primary key binding
>> signature? If not, perhaps it makes sense to change the language in
>> 11.1.1 to say something like:
>> 
>
>> if a subkey binding signature includes the Key Flags subpacket and
>> the certification capability (0x1) or the signing capability (0x2)
>> is set, then the subkey binding signature must also contain a valid
>> primary key binding signature issued by the subkey over the primary
>> key.
>> 
>
>> Neal
>> 
>
>> _______________________________________________
>> openpgp mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/openpgp