Re: [openpgp] marking subkeys as constrained for specific use -- new key usage flags?
Werner Koch <wk@gnupg.org> Tue, 05 March 2013 16:02 UTC
Return-Path: <wk@gnupg.org>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7050721F8883 for <openpgp@ietfa.amsl.com>; Tue, 5 Mar 2013 08:02:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -12.599
X-Spam-Level:
X-Spam-Status: No, score=-12.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, GB_I_LETTER=-2, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eWbY21o2bwCq for <openpgp@ietfa.amsl.com>; Tue, 5 Mar 2013 08:02:49 -0800 (PST)
Received: from kerckhoffs.g10code.com (kerckhoffs.g10code.com [217.69.77.222]) by ietfa.amsl.com (Postfix) with ESMTP id B1ACB21F8639 for <openpgp@ietf.org>; Tue, 5 Mar 2013 08:02:49 -0800 (PST)
Received: from uucp by kerckhoffs.g10code.com with local-rmail (Exim 4.72 #1 (Debian)) id 1UCuKH-0006EP-62 for <openpgp@ietf.org>; Tue, 05 Mar 2013 17:02:49 +0100
Received: from wk by vigenere.g10code.de with local (Exim 4.77 #3 (Debian)) id 1UCuCz-0001Bn-Qp; Tue, 05 Mar 2013 16:55:17 +0100
From: Werner Koch <wk@gnupg.org>
To: David Shaw <dshaw@jabberwocky.com>
References: <5135BDE6.1070200@fifthhorseman.net> <6F1173CD-290C-4A38-BD80-152C5E553D1F@jabberwocky.com>
Organisation: g10 Code GmbH
X-message-flag: Mails containing HTML will not be read! Please send only plain text.
OpenPGP: id=1E42B367; url=finger:wk@g10code.com
Date: Tue, 05 Mar 2013 16:55:17 +0100
In-Reply-To: <6F1173CD-290C-4A38-BD80-152C5E553D1F@jabberwocky.com> (David Shaw's message of "Tue, 5 Mar 2013 10:19:12 -0500")
Message-ID: <87obexlu3e.fsf@vigenere.g10code.de>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Cc: IETF OpenPGP <openpgp@ietf.org>, Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Subject: Re: [openpgp] marking subkeys as constrained for specific use -- new key usage flags?
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/openpgp>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Mar 2013 16:02:50 -0000
On Tue, 5 Mar 2013 16:19, dshaw@jabberwocky.com said: > plan, though, as without adding code to GPG to understand your > notation, you won't easily be able to show a connection from your > OpenPGP key to the OTR subkey. Actually this would be an argument in favor of key flags - the changes to the code would be much easier. RFC4880 says about key flags: This subpacket contains a list of binary flags that hold information about a key. It is a string of octets, and an implementation MUST NOT assume a fixed size. This is so it can grow over time. If a ^^^^^^^^^^^^^^^^^^^ list is shorter than an implementation expects, the unstated flags are considered to be zero. The defined flags are as follows: Thus back in 1997/98 we must have assumed that key flags are a useful thing. I agree that we should not add new key flags without a strong reason. XMPP, however, is evolving to a very useful protocol and OTR is the preferred way of securing it in the real world (much like PGP was used instead of X.509). A discussion right now at cryptography@ stresses the importance of OTR over the originally designed Jabber security features. Given that OTR is a different use case than data storage or mail encryption, I think adding a new key flags for OTR is justified. Maybe we could come up with a more generic term, but to me OTR would be fine ('o' is not yet used as letter describing a key capability ;-). While we are at it: What about using 0x40 of the first octet to indicate that the private component of the key is stored on offline medium? That "offline key" would nicely go with "split key" (0x10) and "group key" (0x80). OTR may then go into the second octet. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
- [openpgp] marking subkeys as constrained for spec… Daniel Kahn Gillmor
- Re: [openpgp] marking subkeys as constrained for … Jon Callas
- Re: [openpgp] marking subkeys as constrained for … David Shaw
- Re: [openpgp] marking subkeys as constrained for … Werner Koch
- Re: [openpgp] marking subkeys as constrained for … Jon Callas
- [openpgp] Offline key flag (was Re: marking subke… David Shaw
- Re: [openpgp] Offline key flag Werner Koch
- Re: [openpgp] Offline key flag David Shaw
- Re: [openpgp] marking subkeys as constrained for … Daniel Kahn Gillmor
- Re: [openpgp] marking subkeys as constrained for … Jon Callas