Re: [openpgp] Fingerprints

Hi,

Christoph Anton Mitterer <calestyo@scientia.net> writes:

> On Fri, 2015-04-24 at 12:11 -0700, Jon Callas wrote: 
>> > And specifying a expiration time (even if it's 0) should be mandatory.
>> That's there now.
> Again, I don't see where this would be specified, except for the
> deprecated v3 keys.
>
> It's not part of the v4 keys, and I can't recall a section which makes
> the key exp sig subpacket mandatory.

I read 4880 again and I'm afraid I was wrong and you are correct; the
key expiration was removed in v4 keys.

Having the subpacket mandatory doesn't help, because the self-sig can
always be reissued.

> Anyway, the idea for making it mandatory has less to do with the
> immutable vs. mutable question... it's rather based on the idea that we
> should IMHO try to strengthen and clarify the whole message format.
> E.g. I think we should convert the critical-bit to be a non-critical
> bit. e.g. everything is considered critical unless explicitly specified
> not to be.

With it being in the self-sig there is no way to make it immutable.  I
could take the top-level key packet and create a new self-sig on it with
a different key-expiration subpacket.  All other signatures on the key
will remain valid (because they don't include the self-sig), and the key
fingerprint wont change (because it doesn't include the selfsig, either).

> Cheers,
> Chris.
> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp

-- 
       Derek Atkins                 617-623-3745
       derek@ihtfp.com             www.ihtfp.com
       Computer and Internet Security Consultant