[openpgp] Re: v4+v6

[Johannes Roth <[e-mail]>]

Hi all,

I support what Daniel says. I see the appeal for the simple 1-to-1 
mapping across OpenPGP versions. However, given that we probably want 
people to move towards PQC, the limitations are unfortunate and will 
lead to additional complexity.

I fear we will still need the replacement key mechanism and then we have 
two different mechanisms and thus more complexity and not less.

If there are serious concerns with the complexity of the replacement key 
draft, perhaps the right approach is to try to simplify it (if possible).

Best,
Johannes

On 10.02.2025 11:04, Daniel Huigens wrote:
> Hi Neal :)
> 
>>From my point of view, the most important use case for having a v6 key
> will be PQC. So, I'll focus on that part of your email:
> 
> On Sunday, February 9th, 2025 at 14:41, Neal H. Walfield wrote:
>> This scheme works, because it it possible to use the same key material
>> for both v4 and v6 keys. It works less well for PQC, but I think it
>> still partially works, because some PQC algorithms use a composite
>> scheme.
>>
>> Given a certificate with an ML-DSA-65+Ed25519 primary key, (I think)
>> it is possible to extract just the Ed25519 public key, and compute the
>> corresponding v4 or v6 key. So we can go from a PQC certificate to v4
>> or v6 certificate.
> 
> The PQC draft says not to do this:
> https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-06.html#name-key-generation-2.
> Generally, reusing key material in different contexts is not advised,
> though I don't know whether there's a practical attack in this case,
> but it'd make the security analysis harder (or even fail to hold,
> formally speaking, as the text suggests).
> 
>> Given a v4 or v6 key, we can't figure out the fingerprint of the
>> corresponding PQC key, because we don't have the PQC public key. But
>> if the PQC certificate is available, we can look it up by its Ed25519
>> public key.
> 
> Looking up the v6 (PQC) key from a keyserver when you only have a v4 key
> would seem like the most useful/important part of this, but this would
> only be possible if keyservers would allow looking up PQC keys by the
> Ed25519 public key, which seems complicated.
> 
> Also, in general (even in the non-PQC case) this seems like a somewhat
> fragile way to look up a v6 key from a v4 key, because you don't know
> whether they reused the key material as you suggest, so the request
> might be insufficient (and conversely they might not have a v6 key
> at all, so the request might also be wasted).
> 
> In essence, compared to this proposal, the key replacement draft places
> additional work on the key holder, to make things more straightforward
> and reliable for the key "consumers", so to speak. And I'd argue that's
> probably a good trade-off to make.
> 
> Best,
> Daniel
> 
> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]