Re: [openpgp] To bind or not to bind

[Justus Winter <[e-mail]>]

Hi Kai :)

Kai Engert <[e-mail]> writes:

> On 21.03.24 21:26, Aron Wussler wrote:
>>   - (1) may be justified because some implementations fail parsing keys [1]. Of this plot is particularly relevant the 3rd line (Unknown algo, opaque encoding, small), that would be equivalent to attach an ML-KEM + X25519 subkey to an existing v4 certificate. All V6 implementations are required not to choke on unknown algorithms.
>
> What kind of failures can be seen with those implementations?
>
> Will they allow importing it, but then run into a failure later on when
> trying to use it? That would be an argument for not distributing such
> keys at all.
>
> Or will ALL of them detect the incompatibilityat import time, and refuse
> the import? That would be less problematic. Then probably v4-pqc and v6
> keys would be rejected in the same way.

The test models an opportunistic upgrade path by taking a v4 certificate
with an usable classical encryption subkey, and adding a fake PQ
encryption subkey.  It then asks the implementations to encrypt a
message for that cert.

SOP, being the Stateless OpenPGP Protocol, doesn't import certificates
as a separate operation, therefore it is impossible to tell where
exactly the whole process fails by looking at the test results alone.

> Users of both v4-pqc and v6 keys would equally have the problem that
> they need to provide classic v4 keys for their incompatible correspondents.
>
> However, if v4-pqc is allowed, it might allow some implementations to
> become compatible with pqc more easily.

That seems to be optimistic speculation, whereas the data says that such
a cert is not a viable opportunistic upgrade path.

Best,
Justus