Re: [openpgp] Call for adoption of draft-gallagher-openpgp-replacementkey

[Andrew Gallagher <[e-mail]>]

On 19 Apr 2024, at 07:48, Falko Strenzke <[e-mail]> wrote:
> As one (maybe naive?) concrete suggestion: Might it make sense to provide the option to simply include the whole replacement certificate in the subpacket? That would address the distribution problem directly. Of course any concerns regarding placement of trust into the replacement key would remain untouched by this.
> 

Hi, Falko.

We did consider this, however it has two concrete disadvantages.

1. It would significantly bloat the old key. Since this is a subpacket of a normal self-signature, it would need to be included in every subsequent self-signature to prevent it being overridden. While this may not be a significant issue on a revoked key, which is unlikely to be further self-signed, this would have a cumulative effect on a non-revoked key (specifically in the "parallel PQC" case).

2. The replacement key in such a subpacket may be stale, particularly if the old key has been revoked and is not being actively updated with newer copies of the replacement. The first thing that an implementation should do on receiving such a key is therefore to check for new signatures online, particularly revocations. If online updates are being done anyway, there is no advantage gained by distributing a stale key.

There are cases where 2. above is impractical, say for systems that do not (regularly) connect to the internet. In such cases, it is simpler and more efficient to distribute a single keyring containing the two keys side by side.

A