[openpgp] Re: I-D Action: draft-ietf-openpgp-replacementkey-05.txt

Andrew Gallagher <andrewg@andrewg.com> Sun, 17 August 2025 14:25 UTC

Return-Path: <andrewg@andrewg.com>
X-Original-To: openpgp@mail2.ietf.org
Delivered-To: openpgp@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 635395518817 for <openpgp@mail2.ietf.org>; Sun, 17 Aug 2025 07:25:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=andrewg.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZfAd8Tre5Kkt for <openpgp@mail2.ietf.org>; Sun, 17 Aug 2025 07:25:06 -0700 (PDT)
Received: from fum.andrewg.com (fum.andrewg.com [135.181.198.78]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E9F2F5518809 for <openpgp@ietf.org>; Sun, 17 Aug 2025 07:25:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=andrewg.com; s=andrewg-com; t=1755440704; bh=p0D+KRzX+niibw1xy8/Wx/HGIi7AFcxHfGI/jKBN82A=; h=From:Subject:Date:References:To:In-Reply-To:From; b=vaa6nRAPbs3w6HjN7aE5eEsce9vIUuxhPU0xT8EJABHUkBBwkvzECrVJdIINdZnKv NOucsthlAgi0nkxjUV6ewYUrKphxPAWdH4ss4KeaqqfYDpYzCwTqkD3d2y4NECI2lq ioFH+QMLdqCfHgz56c8SbLD0DM6opjJHwHCr6zB6zRc/qpeAs8GuLdZIvBul+Z6jXe MlvKknXJ3OkWQZ0+8Lte9T3xSknS8R81Zabu+HHMfCynR4Ekpu5rTQXxCwezIavU4W DvYCTeI7+qN+SQqn+ZVkqgosWUfvWK72Uyr75cFmYe0OVA34VAnZbIerTTNW/wQHi7 26Y7ZiQSc+oLg==
Received: from smtpclient.apple (serenity [IPv6:fc93:5820:7349:eda2:99a7::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by fum.andrewg.com (Postfix) with ESMTPSA id AF3565ED9A for <openpgp@ietf.org>; Sun, 17 Aug 2025 14:25:04 +0000 (UTC)
From: Andrew Gallagher <andrewg@andrewg.com>
Content-Type: multipart/signed; boundary="Apple-Mail=_74066F56-CC4D-49E0-A256-F38B4E49058D"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6.1.21\))
Date: Sun, 17 Aug 2025 15:24:46 +0100
References: <175543972785.266764.14221991647266152456@dt-datatracker-d8bcd59c-frtgg>
To: IETF OpenPGP WG <openpgp@ietf.org>
In-Reply-To: <175543972785.266764.14221991647266152456@dt-datatracker-d8bcd59c-frtgg>
Message-Id: <EC92B437-047A-446B-B1AC-57B162270526@andrewg.com>
X-Mailer: Apple Mail (2.3731.700.6.1.21)
Message-ID-Hash: C6YICJ7AXRO5F67RUOH2M5OWJ2GNARIW
X-Message-ID-Hash: C6YICJ7AXRO5F67RUOH2M5OWJ2GNARIW
X-MailFrom: andrewg@andrewg.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-openpgp.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [openpgp] Re: I-D Action: draft-ietf-openpgp-replacementkey-05.txt
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/tWeB77p6soumqVxN8emEEj1dIQI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Owner: <mailto:openpgp-owner@ietf.org>
List-Post: <mailto:openpgp@ietf.org>
List-Subscribe: <mailto:openpgp-join@ietf.org>
List-Unsubscribe: <mailto:openpgp-leave@ietf.org>

Hi, all.

I have made several changes to the Key Replacement draft to address concerns recently raised both on the list and privately, and to fix up various nits. These have now been published on the datatracker as draft-ietf-openpgp-replacementkey-05 (see below).

The terminology changes alone have touched a significant number of the lines in the draft, however the majority of the changes are editorial. There have been a few small BCP14 changes (MUST/SHOULD), but none to the wire format.

The following questions raised by dkg remain open. I asked for other opinions, but nobody else has yet responded:

* The size and conditional inclusion of the target record length field (currently 2 octets and unconditional).
* Whether to specify (here or elsewhere?) that all unknown revocation reasons are hard.

I also have not yet made dkg’s suggested changes to the structure of the examples section. I believe I have addressed the remainder of dkg’s feedback, as well as all of Aron’s and Falko’s (but please feel free to correct me!).

In addition, there are two tickets open in the issue tracker [1] for earlier design suggestions to enable finer-grained controls of encryption subkey selection. The rough consensus for both was “won’t do”, and I am not aware of this consensus having changed in the meantime.

If you have submitted feedback, please check that it has either been addressed, or is listed above. If someone else’s feedback is listed above and you have not yet expressed an opinion, please feel free to do so. If any feedback has not been satisfactorily addressed, or if you have new feedback about any other matter, please let me know.

Thanks,
A

[1] https://gitlab.com/andrewgdotcom/openpgp-replacementkey/-/issues/


> On 17 Aug 2025, at 15:08, internet-drafts@ietf.org wrote:
> 
> Internet-Draft draft-ietf-openpgp-replacementkey-05.txt is now available. It
> is a work item of the Open Specification for Pretty Good Privacy (OPENPGP) WG
> of the IETF.
> 
>   Title:   OpenPGP Key Replacement
>   Authors: Daphne Shaw
>            Andrew Gallagher
>   Name:    draft-ietf-openpgp-replacementkey-05.txt
>   Pages:   23
>   Dates:   2025-08-17
> 
> Abstract:
> 
>   This document specifies a method in OpenPGP to suggest a replacement
>   for an expired, revoked, or deprecated primary key.
> 
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-openpgp-replacementkey/
> 
> There is also an HTMLized version available at:
> https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-replacementkey-05
> 
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-openpgp-replacementkey-05
> 
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
> 
> 
> _______________________________________________
> openpgp mailing list -- openpgp@ietf.org
> To unsubscribe send an email to openpgp-leave@ietf.org