Re: [openpgp] To bind or not to bind

[Aron Wussler <[e-mail]>]

Hi Justus,

> > (1) Whether PQC encryption algorithms can be used only in v6 keys
> 

> 

> Yes, do bind PQC to v6 keys:
> 

> - Move to PQC is either intrinsically motivated or a regulatory
> requirement. Moving to v6 OpenPGP doesn't have the same advantage, so
> let's leverage the motivation to move to PQC to get v6 adopted
> quickly.
> 

> - v4 OpenPGP implementations are not robust enough to handle unknown
> subkeys. Adding PQC encryption subkeys to v4 certificates is not a
> viable opportunistic upgrade path, but a way to make your existing
> certificate unusable:
 

I somehow still think that forbidding V4 PQC encryption does push toward V6 (note that to get regulatory compliance and signatures you need V6),
and I am not so sure those test failures matter that much.

> > (2) Whether PQC encryption algorithms can be used only with SEIPDv2
> 

> 

> No, don't bind PQC encryption to SEIPDv2. It should be possible to have
> a "PKESKv3(classical) PKESKv6(PQC) SEIPDv1" message:

Agreed, with the same caveat as X25519/X448 of being bound to AES symmetric algos

Cheers,
Aron