[openpgp] "TSK grammar" update in persistent symmetric keys

[Daniel Kahn Gillmor <[e-mail]>]

Hey folks--

(this is with no hats on, just as an interested reviewer)

I just read through draft-ietf-openpgp-persistent-symmetric-keys again
and i'm struck by this section:

> The Transferable Secret Key grammar defined in section 10.2 of
> [RFC9580] is extended to allow including Persistent Symmetric Key
> Packets. Persistent Symmetric Keys may be included together with
> asymmetric keys in a single sequence of Transferable Secret
> Keys. However, Persistent Symmetric Keys do not accept subcomponents,
> such as subkeys, User IDs, or direct-key signatures.

I think "is extended to allow" is not clear. Does it "allow" them as a
subkey for an existing primary key (for example)? Does it allow them
only in place of a primary key? If it allows them in place of a primary
key, but direct-key signatures are not allowed, doesn't that make the
whole grammar invalid, since a direct-key signature from the primary is
required for the TSK?

I see (at least) two different ways to resolve this:

 - provide an explicit grammar (at least as explicit as the v6
   certificate grammar) for TSKs that includes PSK packets, or
   
 - define a new "sequence of packets" specifically for PSKs, which could
   be as simple as the grammar for detached signatures.

Also, i don't know that RFC 9580 really gets into the idea of a
"sequence of Transferable Secret Keys". section 10 of 9580 seems to talk
about a series of packets which are to be interpreted as a TSK, but it
doesn't really go into detail about sequences of TSKs themselves. This
is in contrast to SOP's KEYS object which does contemplate such an
object.

How do folks think this should be resolved? Or is there actually not a
problem here, and i'm just confused?

I've opened an issue in the issue tracker about this as well, if folks
would rather follow up there:

https://gitlab.com/twisstle/openpgp-persistent-symmetric-keys/-/work_items/4

Regards,

        --dkg