Re: [openpgp] Call for adoption of draft-gallagher-openpgp-replacementkey

[Simon Josefsson <[e-mail]>]

Andrew Gallagher <andrewg=[e-mail]> writes:

> On 7 Apr 2024, at 08:37, Simon Josefsson <simon=[e-mail]> wrote:
>> 
>> There seems to be a gap between the draft and the motivation above,
>> regarding one crucial aspect: the draft does not suggest that any
>> automatic processing of the new key should be done, but instead rather
>> recommends against that, saying that the replacement key should be
>> validated as any other key.  
>
> There is no conflict here - trust calculations are generally performed
> automatically, as are key discovery and key selection.  The draft
> merely says that the new subpacket conveys no *extra* trust to the new
> key that it would not otherwise have. It does not prevent automatic
> processing.
>
> a) if a trusted key has a replacement key subpacket pointing to an
> unknown key, that key can be automatically obtained (by the usual
> means), and
>
> b) if two trusted keys are available, and one has a replacement key
> subpacket pointing to the other, the second should be preferred
>
> Neither of these require explicit user intervention.

Hi Andrew.  If automatic processing is one intended purpose use of the
specification, some discussion of how that is intended to happen is
needed.  Right now it was not possible for me to tell what the purpose
of the draft is, so I think going back and answer "What problem are we
trying to solve?" first will help get a reviews for this in the right
context.  Hopefully that isn't difficult?

If automatic processing is intended, I think readers should come away
with some understanding of how that automatic processing is intended to
be implemented given a key that has 0, 1, 2 and 300.000 replacementkey
subpackets.

/Simon