Re: [openpgp] To bind or not to bind

Hi Aron,

On 21.03.2024 21:26, Aron Wussler wrote:
> Hello list,
> 
> Here's the follow-up on the dilemma we had at the IETF 119 session, whether PQC encryption should be bound to V6 or allowed with V4.
> 
> Note that this translates into two different issues:
> 
>   (1) Whether PQC encryption algorithms can be used only in v6 keys
>   (2) Whether PQC encryption algorithms can be used only with SEIPDv2
> 
> Note that (2) implies (1).

I think you are mistaken here and (2) does not imply (1) since you can 
have a SEIPDv2-capable v4 key. Your statement regarding the new failure 
mode for (2) is a bit unprecise: More preceisely, the problem arises 
when there is a non-SEIPDv2-capable recipient (most probably a v4 
certificate without the features flag) and a "PQC-only" recipient where 
no traditional key can be used for SEIPDv1 instead.

> Please provide feedback on your preferences, use-cases, and motivations!

I am against (2) due to introducing the new failure mode.
I am in strong support of allowing v4 PQC keys. The compatibility 
concerns can be added to the migration considerations. I see value in 
having an independent upgrade path for PQC encryption.

- Johannes

> 
> At the session the following arguments were already raised:
>   - (1) may be justified because some implementations fail parsing keys [1]. Of this plot is particularly relevant the 3rd line (Unknown algo, opaque encoding, small), that would be equivalent to attach an ML-KEM + X25519 subkey to an existing v4 certificate. All V6 implementations are required not to choke on unknown algorithms.
>   - TLS disallowed PQC in version 1.2 to promote the migration to 1.3
>   - (2) implies a new failure mode for OpenPGP, where a message can not be sent to two different recipients having a v4 and a PQC key.
> 
> Cheers,
> Aron
> 
> 
> 
> [1] https://tests.sequoia-pgp.org/#Mock_PQ_subkey
> 
> 
> --
> Aron Wussler
> Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930
> 
> 
> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp

-- 
MTG AG
Johannes Roth
Software Developer

Phone: +49 6151 8000 174
E-Mail: johannes.roth@mtg.de
Web: www.mtg.de

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email. Unauthorised
copying or distribution of this email is not permitted.

Data protection information: www.mtg.de/en/privacy-policy