[openpgp] Re: I-D Action: draft-ietf-openpgp-replacementkey-02.txt

[Andrew Gallagher <[e-mail]>]

Hi, Johannes.

On 12 Dec 2024, at 10:27, Johannes Roth <[e-mail]> wrote:

> I also have quick question: Are chains for forward replacements supposed to be allowed, e.g. A claims to be replaced by B and B claims to be replaced by C? From what I read in the draft it should be allowed. In that case I'll have some feedback. If no chains are allowed, I'll have less feedback.

If a valid equivalence binding exists (i.e. two certs A and B, where A indicates that B is its replacement and B indicates that A is its original/fallback), it is not possible to create a chain. This is because only one live subpacket can be present in each self-signature, and that subpacket is either a forwards or an inverse subpacket. While it is possible for an inverse subpacket to refer to multiple originals, it is not possible to mix forwards and inverse references in the same self-signature.

If however there are no inverse subpackets, then it is possible to create a chain of references - e.g. cert A may have a forward reference to cert B and cert B may have a forwards reference to cert C (instead of an inverse reference to A). We did not explicitly prohibit this since such a construction is merely advisory, however it may be prudent to implement a limit on how many such references should be followed.

A