[openpgp] [Technical Errata Reported] RFC4880 (7889)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 10 April 2024 17:17 UTC

To: jon@callas.org, lutz@iks-jena.de, hal@finney.org, dshaw@jabberwocky.com, rodney@canola-jones.com, debcooley1@gmail.com, paul.wouters@aiven.io, stephen.farrell@cs.tcd.ie, dkg@fifthhorseman.net
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: dkg@fifthhorseman.net, openpgp@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240410171711.8A43F13BB51E@rfcpa.amsl.com>
Date: Wed, 10 Apr 2024 10:17:11 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/mu8Qu3Ri1395tttPhc-v4gkphHI>
Subject: [openpgp] [Technical Errata Reported] RFC4880 (7889)
Precedence: list

The following errata report has been submitted for RFC4880,
"OpenPGP Message Format".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7889

--------------------------------------
Type: Technical
Reported by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

Section: 5.2.3.23

Original Text
-------------
Note that any signature may be revoked, including a certification on some other person's key.

Corrected Text
--------------
Note that any certification may be revoked, including a certification on some other person's key.

Notes
-----
the only three types of revocation that are specified in OpenPGP are:

0x20: Key revocation signature
The signature is calculated directly on the key being revoked. A
revoked key is not to be used. Only revocation signatures by the
key being revoked, or by an authorized revocation key, should be
considered valid revocation signatures.

0x28: Subkey revocation signature
The signature is calculated directly on the subkey being revoked.
A revoked subkey is not to be used. Only revocation signatures
by the top-level signature key that is bound to this subkey, or
by an authorized revocation key, should be considered valid
revocation signatures.

0x30: Certification revocation signature
This signature revokes an earlier User ID certification signature
(signature class 0x10 through 0x13) or direct-key signature
(0x1F). It should be issued by the same key that issued the
revoked signature or an authorized revocation key. The signature
is computed over the same data as the certificate that it
revokes, and should have a later creation date than that
certificate.

There is no explicit mechanism to revoke a document signature (as opposed to a certification signature), so it makes no sense to claim that "any signature may be revoked".

This was observed by Andrew Gallagher in https://gitlab.com/dkg/openpgp-revocation/-/issues/15, and is still an issue in the successor to RFC 4880, draft-ietf-openpgp-crypto-refresh ☹

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC4880 (draft-ietf-openpgp-rfc2440bis-22)
--------------------------------------
Title : OpenPGP Message Format
Publication Date : November 2007
Author(s) : J. Callas, L. Donnerhacke, H. Finney, D. Shaw, R. Thayer
Category : PROPOSED STANDARD
Source : Open Specification for Pretty Good Privacy
Stream : IETF
Verifying Party : IESG

[openpgp] [Technical Errata Reported] RFC4880 (78… RFC Errata System