[openpgp] Re: Encryption subkey selection

[Justus Winter <[e-mail]>]

Hey list :)

Daniel Huigens <d.huigens=[e-mail]> writes:

> I agree that it would be good to reach a consensus on this, and that
> if we assume that we want to support one-subkey-per-device setups
> (e.g. for use with integrated HSMs, to be able to generate a key
> on each of your devices in hardware), which seemed to be the
> conclusion from the multi-device session at the summit,
> then we probably need some mechanism for that.
>
> _However_, I want to raise one specific potential solution that
> Patrick Brunschwig proposed in that session, which is a variant of
> "List of sets of subkeys", but rather than introducing some new
> encoding for this, we could simply say: each certificate is such
> a list of subkeys. In other words, we pick the first certificate,
> see if it's usable, if so use all valid encryption subkeys in that
> certificate. If not, try the next certificate. And so on.
>
> This means that, to migrate to a new encryption algorithm, you also
> need to generate a new certificate. Often we want to do that anyway:
> in the migration from RSA to ECC, and ECC to PQC, we've introduced
> both new encryption algorithms and new signing algorithms.
>
> I know this goes a bit against what I've said previously and also
> conflicts with the concept of "certificate equivalence" in the
> key replacement draft (because multiple subkeys across linked certs
> would then not behave the same as multiple subkeys in a single cert).
> _But_ if we all agree that we need some mechanism for this then
> I think it's best to pick the simplest possible mechanism.

That indeed sounds like a simple solution.  And I agree that we should
get more comfortable with primary key rotations, so I'm not too worried
with tying subkey rotations with primary key rotations.

Best,
Justus