Re: [openpgp] To bind or not to bind

[Kai Engert <[e-mail]>]

On 21.03.24 21:26, Aron Wussler wrote:
>   - (1) may be justified because some implementations fail parsing keys [1]. Of this plot is particularly relevant the 3rd line (Unknown algo, opaque encoding, small), that would be equivalent to attach an ML-KEM + X25519 subkey to an existing v4 certificate. All V6 implementations are required not to choke on unknown algorithms.

What kind of failures can be seen with those implementations?

Will they allow importing it, but then run into a failure later on when 
trying to use it? That would be an argument for not distributing such 
keys at all.

Or will ALL of them detect the incompatibilityat import time, and refuse 
the import? That would be less problematic. Then probably v4-pqc and v6 
keys would be rejected in the same way.

Users of both v4-pqc and v6 keys would equally have the problem that 
they need to provide classic v4 keys for their incompatible correspondents.

However, if v4-pqc is allowed, it might allow some implementations to 
become compatible with pqc more easily.

Kai