Return-Path: X-Original-To: openpgp@mail2.ietf.org Delivered-To: openpgp@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 20CB05CB1716 for ; Wed, 3 Sep 2025 07:14:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -0.256 X-Spam-Level: X-Spam-Status: No, score=-0.256 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DATE_IN_PAST_12_24=1.049, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b="oj2f/rdu"; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b="Mn3bN4HB" Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3KerxrBvKcub for ; Wed, 3 Sep 2025 07:14:35 -0700 (PDT) Received: from che.mayfirst.org (unknown [162.247.75.118]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 7679B5CB16D5 for ; Wed, 3 Sep 2025 07:14:35 -0700 (PDT) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1756908874; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=l4aX62djKp122N8RO+sGPTev37x/ykhzl8YQ0aOzakE=; b=oj2f/rdu4M/xp8Dli/KFkF79aFEeQgb1OcUuGIQNMfeOZN2X6u6/iPpLu7dJKBfxIPBrX wgd3pHN+yMfg19BCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1756908874; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=l4aX62djKp122N8RO+sGPTev37x/ykhzl8YQ0aOzakE=; b=Mn3bN4HBFp6+9sIAAZGfjdTLMNFLPibHOrCvZcVU2Trxds2QRN/x93LaWkVpex6s4pUMh yF3BWu8/jGRy1Va0mCxSQl3fpKXLUpTCqMmR2eU4oy7tOa4HF1zA/B3IaxR3EZT8dIvtrFB RTuYpa/3o1DzaRaQT5mPA9vNKrcaKJthf86jR7uuRaB8n7L+DzFJE8cc5Jk2ITtvD+xLrXg ehRlsyaYly0IHLowRmihYN5pij7VO3RldMcjepR7v7Ub/UPAjx084LicOevWlzW1xQ2V2tm sIWlCsV0BXlEzCzdEXRFVzWTN8aLk602xl7J5RRqIFE4YlHtYcgUhFl8buIQ== Received: from fifthhorseman.net (AMERICAN-CI.ear2.NewYork6.Level3.net [4.59.214.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id C81A9F94B; Wed, 03 Sep 2025 10:14:34 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id D138813F6BF; Tue, 02 Sep 2025 18:18:11 -0400 (EDT) From: Daniel Kahn Gillmor To: Andrew Gallagher , IETF OpenPGP WG In-Reply-To: <01DBC972-6BC8-482D-BF04-D2023FF1A543@andrewg.com> References: <175543972785.266764.14221991647266152456@dt-datatracker-d8bcd59c-frtgg> <01DBC972-6BC8-482D-BF04-D2023FF1A543@andrewg.com> Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= xjMEZXEJyxYJKwYBBAHaRw8BAQdA5BpbW0bpl5qCng/RiqwhQINrplDMSS5JsO/YO+5Zi7HNFzxk a2dAZmlmdGhob3JzZW1hbi5uZXQ+wsARBBMWCgB5AwsJB0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u cy5zZXF1b2lhLXBncC5vcmcS78JIJ7JbALqPiKEmva7/Pp16WwXWm9hbe5+B/UvnfwMVCggCmwEC HgEWIQTUdwQMcMIValwphUm7fpEBSV5r9wUCZadfkAUJBdnwRQAKCRC7fpEBSV5r9yNXAP442N0c zvisBroQSKKpo+OWm2JpnEJWoVheeJvoRtkBGQEA+edHylby8IGcNccq7rmM2rAXdofvrU1o6qow V+mmDwbOMwRnio4OFgkrBgEEAdpHDwEBB0Cw9HzJFl9lZn3UBaUqSMSgxjcdbd0MwNVcGZ8t8wdN EcLAvwQYFgoBMQWCZ4qODgkQu36RAUlea/dHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p YS1wZ3Aub3JnhcN+tn41cAg01Kk56zcAfpdsh8j98PDe00mqKPfFvaYCmwK+oAQZFgoAbwWCZ4qO DgkQeAuFTtnCtJZHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnxsD8Sk5P Wgx8c/Zseo6OlCjyDC+Ogm17gTaUUIpxjWYWIQRjrBGOWy5dZsiKhad4C4VO2cK0lgAAdcQA/1RG dmrmvVxkBY2qNPjtERNwPga8Pf4IdlenrZ03NXM4AQC+TDHMpD7d5obEvUy8GYI3oThzYItPP8vv ChY+wbaIBRYhBNR3BAxwwhVqXCmFSbt+kQFJXmv3AAAKbgD+K1MZXnRKPdmA8DgNysyGRZY8cSVH HQcC7ZAAtV3i2+wA/0CyOYrbFYbyTRALgoERR07OHFoP+fJopQLMNQARVUELzjgEZ4qN+RIKKwYB BAGXVQEFAQEHQDTGlR+Qmn334e+bPqvojJVdFsiBf0leAAHP+ESqop8NAwEIB8LAAAQYFgoAcgWC Z4qN+QkQu36RAUlea/dHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnA5Lw b3wOOcoodImuVNw4PYq1U65FDC1Q2JMFIcJXqF0CmwwWIQTUdwQMcMIValwphUm7fpEBSV5r9wAA 6egA/j3QANSmogZ5VTF5KlI+BBye9ud/w9j7RLcCHU6u8AA1AQC3FGaNuv+uWOSa+eeEoI/aZrGd X5el8b/m6aXDDxDjDg== Date: Tue, 02 Sep 2025 18:18:11 -0400 Message-ID: <87tt1kcxcs.fsf@fifthhorseman.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Message-ID-Hash: F35QITOPX5ILPUEXGE6NM5QZQ3TINB3W X-Message-ID-Hash: F35QITOPX5ILPUEXGE6NM5QZQ3TINB3W X-MailFrom: dkg@fifthhorseman.net X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-openpgp.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5Bopenpgp=5D_Re=3A_I-D_Action=3A_draft-ietf-openpgp-replacementke?= =?utf-8?q?y-05=2Etxt?= List-Id: "Ongoing discussion of OpenPGP issues." Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Mon 2025-08-18 12:14:50 +0100, Andrew Gallagher wrote: > * if a Replacement Key subpacket is included in a revocation signature, t= hen the Reason For Revocation subpacket SHOULD indicate "Key is superseded= =E2=80=9D. > > This already implies that =E2=80=9CKey is retired and no longer used=E2= =80=9D SHOULD NOT be used with a Replacement Key subpacket. If we make this= explicit, then we should be able to sidestep the question of =E2=80=9Cwhat= is a hard revocation". I like this. Looking in git, i think you've made reasonable changes, in particular changing that SHOULD to a MUST, and having the RKSP only be meaningful in a "key is superseded" revocation signature. I think this is a simple and clean path forward. --dkg --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRjrBGOWy5dZsiKhad4C4VO2cK0lgUCaLdtIwAKCRB4C4VO2cK0 lvjaAP934geMCzWGrjlISQLTS6ajjqBNScs9osSvtY4hYQbeAQEAnEukpnsLzgT+ rePT3zvNyYv6849DL4xdwmCGxKvAfwQ= =c/ka -----END PGP SIGNATURE----- --=-=-=--