[openpgp] Re: I-D Action: draft-ietf-openpgp-replacementkey-01.txt

[Andrew Gallagher <[e-mail]>]

On 1 Nov 2024, at 19:22, Heiko Schäfer <[e-mail]> wrote:
> 
>  Hey Andrew, list,

Hey Heiko :-)

> I think it's very useful to specify a format for replacement, and to finalize it sooner rather than later

I said at the interim that I hoped to get the spec finalised by the end of the year, and if we can avoid scope creep I think this target is still realistic… just!

> I'd want to always see the Fingerprint included. Fingerprints are, after all, currently commonly used for keyserver lookup.
> A replacement key format that requires reworking keyserver APIs before it can be used to obtain certificates over the network seems unreasonably aspirational to me.

I agree. I have included an optional fingerprint field at the request of the interim meeting, however I am personally very wary of this option, for the reasons you have outlined.

> FWIW, I'm not convinced that including the imprint adds value that justifies the complexity it brings.


I’m sympathetic to this position. The imprint is included to bring the cryptographic strength up to the same level as an sbind or certification, but defends more against a theoretical concern than a practical one. So long as it is used as a supplement for a fingerprint and not a replacement, I can live with that.

That said, I’d really like to hear from other implementers about whether they think the added code burden is reasonable. 

A