[openpgp] Re: Splitting replacement keys subpacket into related keys and trust equivalence?

[Heiko Schäfer <[e-mail]>]

As Andrew outlined, in some of the existing PKI mechanisms, the 
fingerprint is currently the best/most specific lookup key.
It would seem unfortunate to me not to include the fingerprint in a 
replacement key mechanism (which is presumably often going to involve 
client software attempting to do PKI lookups).

Heiko


On 9/13/24 1:48 PM, Bart Butler wrote:
> I’m fairly agnostic on this as long as we don’t make it optional and 
> introduce yet another degree of freedom. One other advantage of not 
> including the fingerprint would be to force implementations to verify 
> using the imprint. But either approach is fine.
>
>
> On Fri, Sep 13, 2024 at 11:01 AM, Andrew Gallagher 
> <andrewg=[e-mail] <mailto:On Fri, Sep 13, 2024 at 
> 11:01 AM, Andrew Gallagher <<a href=>> wrote:
>> On 13 Sep 2024, at 08:42, Daniel Huigens <[e-mail]> 
>> wrote:
>> >
>> > In the email case specifically, you _could_ take it as a signal to say,
>> > "oh there's a replacement key, but I don't know where/which it is,
>> > so I need to go fetch this contact's keys again (by email address)".
>>
>> Sure, but I’m thinking specifically of the cases where lookup by 
>> email address isn’t efficient, e.g. if there is no WKD on the domain 
>> and there are a number of fake keys on the keyservers. If we compare 
>> with the design goal of trying to match the behaviour of subkeys as 
>> much as possible, leaving out fingerprints does complicate the lookup 
>> process in the general case.
>>
>> A
>> _______________________________________________
>> openpgp mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>
> _______________________________________________
> openpgp mailing list [e-mail]
> To unsubscribe send an email [e-mail]