Re: [openpgp] primary key binding signature requirement

[Aron Wussler <[e-mail]>]

Hi Neal,

> if a subkey binding signature includes the Key Flags subpacket and
> the certification capability (0x1) or the signing capability (0x2)
> is set, then the subkey binding signature must also contain a valid
> primary key binding signature issued by the subkey over the primary
> key.

I agree with this.

As a side note, I don't know whether we should allow subkeys to issue certifications.

In real life I found poor support for subkeys with certification capability. I found no real way to create such keys (without messing with them manually) and other implementations didn't understand certifications made from that key.

Maybe we should either forbid that entirely or explicitly support it.

Cheers,
Aron


--
Aron Wussler
Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930



------- Original Message -------
On Thursday, December 1st, 2022 at 10:33, Neal H. Walfield <[e-mail]> wrote:


> Section 11.1.1 Common requirements says:
> 

> Each Subkey packet MUST be followed by one Signature packet, which
> should be a subkey binding signature issued by the top-level key.
> For subkeys that can issue signatures, the subkey binding signature
> MUST contain an Embedded Signature subpacket with a primary key
> binding signature (0x19) issued by the subkey on the top-level key.
> 

> https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-07#section-11.1.4
> 

> What does it mean for a subkey to issue signatures? I think
> authentication subkeys technically issue signatures, but they don't
> normally include a primary key binding signature. For instance,
> here's the `sq packet dump` output for an authentication-capable
> subkey created using gpg 2.2.27:
> 

> Public-Subkey Packet, old CTB, 397 bytes
> Version: 4
> Creation time: 2022-12-01 09:26:21 UTC
> Pk algo: RSA
> Pk size: 3072 bits
> Fingerprint: 136ABFA01DD47269514F757B10F4A631F1CB5D14
> KeyID: 10F4A631F1CB5D14
> 

> Signature Packet, old CTB, 438 bytes
> Version: 4
> Type: SubkeyBinding
> Pk algo: RSA
> Hash algo: SHA512
> Hashed area:
> Issuer Fingerprint: 188A993D54814E76FF988779E962990F14D5ACA4
> Signature creation time: 2022-12-01 09:26:21 UTC
> Key flags: A
> Unhashed area:
> Issuer: E962990F14D5ACA4
> Digest prefix: 3C63
> Level: 0 (signature over data)
> 

> Should authentication-capable subkeys include a primary key binding
> signature? If not, perhaps it makes sense to change the language in
> 11.1.1 to say something like:
> 

> if a subkey binding signature includes the Key Flags subpacket and
> the certification capability (0x1) or the signing capability (0x2)
> is set, then the subkey binding signature must also contain a valid
> primary key binding signature issued by the subkey over the primary
> key.
> 

> Neal
> 

> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp