[openpgp] Next steps in draft-ietf-openpgp-external-secrets

[Heiko Schäfer <[e-mail]>]

Hello list,

I wanted to send an update on the status and next steps for 
draft-ietf-openpgp-external-secrets.
This draft proposes a standardized mechanism for using hardware-backed 
OpenPGP key material (for example with OpenPGP card devices or HSMs).


# Locator hint changes (MR !11)

This merge request [1] changes the locator hint:

(1) The default guidance for an "external-secrets" key packet is changed 
from "best effort" to "unavailable".

This introduces the semantic of "unavailable" to the draft, as a way to 
signal that an application should not attempt to get access to the 
private key parameters for a secret key packet (this is appropriate e.g. 
for an air-gapped primary key packet).

Dkg, Paul Schaub and me all felt that it seems marginally preferable to 
define "unavaiable" as the default meaning (when no locator hint data is 
present).


(2) To be able to encode the (previously default) semantic of "best 
effort", which asks an application to go look for hardware devices that 
can be used to access the associated private key material, the draft now 
defines locator hint id 0.

This also prepares the ground for adding more metadata to the key 
packets, as part of the locator hint data.


The MR also updates the test vectors to reflect the changes it makes in 
the text.

This MR has seen quite a bit of discussion on gitlab, and I think is in 
sensible shape now.
If no one speaks up with concerns, I'll merge this MR very soon (we can 
always iterate more, after).


# Add user-facing "device name" metadata

Issue #6 explores the idea of storing a device name as part of an 
"external secrets" key packet [2].
This string would be set by the key holder, to enable their software to 
show this name when prompting the user to make the device available.

A device name could be "Purple USB fob", so that the user's email 
software could prompt them to "Please attach <Purple USB fob> to 
decrypt" (or similarly to ask the user to provide a PIN for this named 
device).

Once !11 is landed, I'll try to propose language for this.


# Registry housekeeping (MR !7)

This MR is an effort to:

(1) Propose the addition of a new code point for "external secret" to 
the S2K usage octet registry
(2) While we're at it, attempt to decouple the S2K usage registry from 
the Symmetric Key Algorithms registry

I think this MR would benefit from more people taking a look and 
weighing in.
The decoupling in (2) would impact the entire OpenPGP ecosystem, beyond 
people who are interested in the external-secrets draft.

---

I hope to merge !11 this week and publish a new version of the draft 
before the 2026-11-02 deadline.

Any feedback would be appreciated!

Thanks,
:) Heiko


[1]: https://gitlab.com/openpgp-wg/external-secrets/-/merge_requests/11
[2]: https://gitlab.com/openpgp-wg/external-secrets/-/work_items/6
[3]: https://gitlab.com/openpgp-wg/external-secrets/-/merge_requests/7