Re: [openpgp] To bind or not to bind

[Michael Richardson <[e-mail]>]

Justus Winter <[e-mail]> wrote:
    > We can not, of course, but we can make an educated guess based on the
    > available data.  I survey a subset of implementations, among them the
    > most notable ones.  And the results indicate that even among the most
    > notable ones (which are presumably of higher quality), we don't see the
    > required robustness that we'd need to do this right now.

Sounds like we could have used some GREASE for OpenPGP: RFC8701.

    > This leads me to believe that many of the unknown implementations (which
    > are presumably of lower quality, not because of a lack of skill, but due
    > to a lower amount of (public) exposure) will also not be robust enough.

:-(

    > As a single data point, we know that Github uses an implementation
    > derived from Google's OpenPGP implementation for Go (which aiui GopenPGP
    > is also derived from).  Assuming the test results for GopenPGPv2 hold
    > for x/crypto/openpgp, adding a PQC encryption subkey to a v4 key would
    > break Github's signature verification.

:-( :-(


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*