IETF Logo Mail Archive

[openpgp] Re: Primary Key Binding sigs on authentication subkeys

Justus Winter <justus@sequoia-pgp.org> Wed, 22 January 2025 16:50 UTC

Return-Path: <justus@sequoia-pgp.org>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA446C151093 for <openpgp@ietfa.amsl.com>; Wed, 22 Jan 2025 08:50:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.103
X-Spam-Level:
X-Spam-Status: No, score=-2.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=sequoia-pgp.org
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cxe4mfPvan1A for <openpgp@ietfa.amsl.com>; Wed, 22 Jan 2025 08:50:38 -0800 (PST)
Received: from mailgate02.uberspace.is (mailgate02.uberspace.is [185.26.156.114]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEACFC14F616 for <openpgp@ietf.org>; Wed, 22 Jan 2025 08:50:37 -0800 (PST)
Received: from harrington.uberspace.de (harrington.uberspace.de [185.26.156.85]) by mailgate02.uberspace.is (Postfix) with ESMTPS id A14BC1814E1 for <openpgp@ietf.org>; Wed, 22 Jan 2025 17:50:35 +0100 (CET)
Received: (qmail 11828 invoked by uid 500); 22 Jan 2025 16:50:35 -0000
Authentication-Results: harrington.uberspace.de; auth=pass (plain)
Received: from unknown (HELO unkown) (::1) by harrington.uberspace.de (Haraka/3.0.1) with ESMTPSA; Wed, 22 Jan 2025 17:50:35 +0100
From: Justus Winter <justus@sequoia-pgp.org>
To: Daniel Huigens <d.huigens=40protonmail.com@dmarc.ietf.org>, Andrew Gallagher <andrewg=40andrewg.com@dmarc.ietf.org>
In-Reply-To: <HBqO7fta_A4PuuS2EkZ4W5g6SAnzgN38ZYjpGWqgZJHCFqCQUNQ-BAXEHRqa7pwGU5jI7s6XpvGV2ZYLpa6se9e-SJDujNO6yknALtzlAW8=@protonmail.com>
References: <D6B824E8-5559-41FB-8EC4-ACC0C35FAEB0@andrewg.com> <HBqO7fta_A4PuuS2EkZ4W5g6SAnzgN38ZYjpGWqgZJHCFqCQUNQ-BAXEHRqa7pwGU5jI7s6XpvGV2ZYLpa6se9e-SJDujNO6yknALtzlAW8=@protonmail.com>
Date: Wed, 22 Jan 2025 17:50:31 +0100
Message-ID: <875xm64wtk.fsf@europ.lan>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
X-Rspamd-Bar: -----
X-Rspamd-Report: BAYES_HAM(-2.981115) SIGNED_PGP(-2) MIME_GOOD(-0.2)
X-Rspamd-Score: -5.181115
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sequoia-pgp.org; s=uberspace; h=from:to:cc:subject:date; bh=pIqaTRvtswupcJcPT0mp/4KJerEaG+V0cN/n99bU2pQ=; b=Ni3v5Q6pn1u5eWRd3D5iBZtqw5CpD7DDh1M5H9ePrh0Gt21cNjShenYR82PJlWvF4CL77jXZel b0ffDgUrJkl/rQQ/SZefiZTpDSihZCKe3hJ67f51C/2j9jx1d+49RmzBR5xMfLl0xu6B+8LHbCan YUob1zabiLwpc7a9BejehH83MiDp+Zz/UQxD/A7aTozp1C+XU6zk99BbpneOCSCNNKm+Acr2wkNd JuKpq0ejxeHVzr2K2c1r2GDydhidodle/Kz+C9tsvQfte1fnYMXj/xWnPEzB1OUKpM1/6RAPIt9k Ygg0q/VkvLbZejZ/1IUe77YrgzvMltdVqpTYgR8jw3nFTz6ynlHLEPpcZHmcDAr5KvAwjf5/kzZr XaSNiZiDHrLczQyw++mdMyBeG0vUOuReXf+tHBgfDzgGBVFbvGWvKj7mB3ee3T8+YJ7n37p/ktk+ GMX98HIYHQeC53OqSRfylv1SRTsZsXwwYkqkdMBog4pU6x3Rjywqo8uQPrMMtzsS3jg3CydAD0vS AU+A0R7jWWVkY8CqSf+iT3kqE4cWxUi+n+rjYM7Md8929WGSn3dULKnkyiRASfR9w9vXO9KKqXio wKkOS+cJvs0CMWxHAkwlWF9ZerX7inNhNdZ8nfBqfbI8jproPiSbvgLfX6ttTeKp5efhobwjLwbv g=
Message-ID-Hash: QEDCQO7VUPVRUCCNQ3CRLJPN3QWDUSR4
X-Message-ID-Hash: QEDCQO7VUPVRUCCNQ3CRLJPN3QWDUSR4
X-MailFrom: justus@sequoia-pgp.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-openpgp.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: IETF OpenPGP WG <openpgp@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [openpgp] Re: Primary Key Binding sigs on authentication subkeys
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/Twhc7btBxlF6BGk4zsmL_Fd5wYY>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Owner: <mailto:openpgp-owner@ietf.org>
List-Post: <mailto:openpgp@ietf.org>
List-Subscribe: <mailto:openpgp-join@ietf.org>
List-Unsubscribe: <mailto:openpgp-leave@ietf.org>

Hi,

Daniel Huigens <d.huigens=40protonmail.com@dmarc.ietf.org> writes:

> So, unless folks think it's worth changing that, we could also consider
> deprecating authentication subkeys entirely, and say that an application
> that (for some reason) wants to do authentication using OpenPGP, should
> use a dedicated key/certificate, and just use a normal signing (sub)key?

Wait, what?  Counting individual uses, I think authentication as in
creating signatures using my authentication-capable subkey is my primary
use case for OpenPGP.

FWIW, Sequoia requires primary key binding signatures on signatures
binding authentication-capable subkeys.

Best,
Justus

v2.46.0 | Report a Bug | By Email | System Status