[openpgp] To bind or not to bind

[Aron Wussler <[e-mail]>]

Hello list,

Here's the follow-up on the dilemma we had at the IETF 119 session, whether PQC encryption should be bound to V6 or allowed with V4.

Note that this translates into two different issues:

 (1) Whether PQC encryption algorithms can be used only in v6 keys
 (2) Whether PQC encryption algorithms can be used only with SEIPDv2

Note that (2) implies (1).

Please provide feedback on your preferences, use-cases, and motivations!

At the session the following arguments were already raised:
 - (1) may be justified because some implementations fail parsing keys [1]. Of this plot is particularly relevant the 3rd line (Unknown algo, opaque encoding, small), that would be equivalent to attach an ML-KEM + X25519 subkey to an existing v4 certificate. All V6 implementations are required not to choke on unknown algorithms.
 - TLS disallowed PQC in version 1.2 to promote the migration to 1.3
 - (2) implies a new failure mode for OpenPGP, where a message can not be sent to two different recipients having a v4 and a PQC key.

Cheers,
Aron    



[1] https://tests.sequoia-pgp.org/#Mock_PQ_subkey


--
Aron Wussler
Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930