From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Werner Koch <wk@gnupg.org>
Thread-Topic: [openpgp] New fingerprint: to v5 or not to v5
Thread-Index: AQHRAA0oGRFnZAPwNU68Rcs3/4z3Np5gESqI
Date: Wed, 7 Oct 2015 14:02:17 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4B2C5EE@uxcn10-5.UoA.auckland.ac.nz>
References: <878u84zy4r.fsf@vigenere.g10code.de>
 <87fv1xxe5w.fsf@alice.fifthhorseman.net>
 <87r3lgcup8.fsf@vigenere.g10code.de>
 <CACsn0c=-LKagSqTbgOV1W4Gu4u-f6vpVq82-nWSLGogjoeFKeg@mail.gmail.com>
 <CAMm+LwjeKDKnN2ZAisbKhWVS4kwCEm_VvcZ1MtftYzEJQpGdhg@mail.gmail.com>
 <87y4fi5wa9.fsf@vigenere.g10code.de>
 <9A043F3CF02CD34C8E74AC1594475C73F4B278ED@uxcn10-5.UoA.auckland.ac.nz>
 <8737xp5z45.fsf@vigenere.g10code.de>
 <9A043F3CF02CD34C8E74AC1594475C73F4B279C6@uxcn10-5.UoA.auckland.ac.nz>,
 <87fv1o4e9n.fsf@vigenere.g10code.de>
In-Reply-To: <87fv1o4e9n.fsf@vigenere.g10code.de>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/openpgp/gXn3U3a73KME5q1_4FjSb8eO2U4>
Cc: Watson Ladd <watsonbladd@gmail.com>,
 Phillip Hallam-Baker <phill@hallambaker.com>,
 Daniel Kahn Gillmor <dkg@fifthhorseman.net>, IETF
 OpenPGP <openpgp@ietf.org>
Subject: Re: [openpgp] New fingerprint: to v5 or not to v5
Precedence: list

Werner Koch <wk@gnupg.org> writes:=0A=
=0A=
>That explicit ID sounds pretty much like a issuer+serialno or one of the=
=0A=
>other X.509 methods to identify a key.  It is not a fingerprint as we know=
 it=0A=
>and it can't be used as a secure identification of the key.=0A=
=0A=
It works quite well as a unique identifier for a key.  The problem here is=
=0A=
that PGP makes the same mistake that's made in things like credit cards and=
=0A=
SSNs, where you've got a magic value that's supposed to be both a unique=0A=
identifier (public) and an authentication/authorisation value (private).=0A=
=0A=
X.509 handles this by having two distinct things, a unique identifier=0A=
(subjectKeyIdentifier) to identify a key, and a fingerprint (hash of the ce=
rt)=0A=
to verify its integrity or whatever it is you want to do with it.=0A=
=0A=
PGP in contrast confuses the two, so you have a supposedly unique identifie=
r=0A=
that hashes in a mutable value (the time) but then doesn't hash in other=0A=
important information like the user ID associated with the key.  So it does=
n't=0A=
work very well either as an identifier or as an integrity-check value.=0A=
=0A=
The fix would be to have two distinct values, a unique identifier (64 or 12=
8=0A=
bits of whatever) to uniquely identify a key, and then a fingerprint that=
=0A=
covers the key, subkey(s), user ID(s), attributes, and whatnot, to check th=
at=0A=
you've got what you were expecting to get.=0A=
=0A=
>Lost key?  =0A=
=0A=
The key is present somewhere on the keyring but the date has changed, so yo=
u=0A=
can't locate it by key ID any more because the date hashed into the other b=
its=0A=
and pieces changes the key ID.=0A=
=0A=
Peter.=