Re: including the entire fingerprint of the issuer in an OpenPGP certification

Jon Callas <> Thu, 20 January 2011 16:00 UTC

Received: from (localhost []) by (8.14.4/8.14.3) with ESMTP id p0KG09Bk059526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 20 Jan 2011 09:00:09 -0700 (MST) (envelope-from
Received: (from majordom@localhost) by (8.14.4/8.13.5/Submit) id p0KG09bR059525; Thu, 20 Jan 2011 09:00:09 -0700 (MST) (envelope-from
X-Authentication-Warning: majordom set sender to using -f
Received: from ( [] (may be forged)) by (8.14.4/8.14.3) with ESMTP id p0KG08YK059520 for <>; Thu, 20 Jan 2011 09:00:08 -0700 (MST) (envelope-from
Received: from localhost (localhost []) by (Postfix) with ESMTP id 265952E0E6 for <>; Thu, 20 Jan 2011 08:00:11 -0800 (PST)
Received: from ([]) by localhost (host.domain.tld []) (amavisd-maia, port 10024) with ESMTP id 13368-05 for <>; Thu, 20 Jan 2011 08:00:08 -0800 (PST)
Received: from ( []) (Authenticated sender: jon) by (Postfix) with ESMTPA id DC8D02E0D0 for <>; Thu, 20 Jan 2011 08:00:08 -0800 (PST)
Received: from [] ([]) by (PGP Universal service); Thu, 20 Jan 2011 08:00:06 -0800
X-PGP-Universal: processed; by on Thu, 20 Jan 2011 08:00:06 -0800
Mime-Version: 1.0 (Apple Message framework v1082)
Subject: Re: including the entire fingerprint of the issuer in an OpenPGP certification
From: Jon Callas <>
In-Reply-To: <>
Date: Thu, 20 Jan 2011 08:00:04 -0800
Message-Id: <>
References: <> <> <> <> <> <> <> <> <>
To: IETF OpenPGP Working Group <>
X-Mailer: Apple Mail (2.1082)
X-PGP-Encoding-Format: Partitioned
X-PGP-Encoding-Version: 2.0.2
X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable
X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii
Content-Type: text/plain; charset="us-ascii"
X-Virus-Scanned: Maia Mailguard
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by id p0KG09YK059521
Precedence: bulk
List-Archive: <>
List-Unsubscribe: <>
List-ID: <>

Hash: SHA1

A side-effect of this is something that's either an obvious extension or in the spec already.

Section 3.3 says: "Implementations SHOULD NOT assume that Key IDs are unique."

It's said that since 2440, for the following reason...

In PGP1 days, Vinnie started working there and told me that he'd generated a key and gotten a certain error when putting it into the keyserver. I was thrilled, because that error was a duplicate keyid error. We'd been having debates over this ourselves. Being a software engineer, I tend to consider assuming that a database key is unique is bad form. I recognize that pseudo-random 64-bit numbers don't collide easily at all, but assuming uniqueness is something that is easily coded around. That key was my proof that engineering-wise, don't assume uniqueness.

Sadly, he had deleted the key and just generated a new one, so that key is the Nessie of key ids. It's a crypto-cryptologist's dream, the true random collision. And we will never know if it was genuine. Sigh.

Nonetheless, that led to that clause in 3.3, and I assert that if an implementation breaks because of a keyid collision, the implementation has a bug.

So you can consider a keyid to just be a database key. The way we do it now (truncating a fingerprint) is a fine way to do it, but the underlying principle is that an implementor really needs to code around the eventuality that there will be a collision and do some right thing.

Yeah, I know it's easier said than done, but that doesn't make it false.

I forget what Terry Pratchett novel has it, but in one of them he has a discussion that anything that is a million-to-one against is a certainty. The million-to-one thing *will* happen. Cryptographers need to keep that principle in the back of their head, too.

Version: PGP Universal 2.10.0 (Build 554)
Charset: us-ascii