Re: [openpgp] To bind or not to bind

[Andrew Gallagher <[e-mail]>]

On 27 Mar 2024, at 12:22, Justus Winter <[e-mail]> wrote:
> 
> I don't think the fix is as straight forward.  Because there are a great
> number of v4 implementations out there, some of which we don't even know
> exist.  How can we know how these are sufficiently robust to support
> this opportunistic upgrade path?

We don’t, but failure is not necessarily a bad thing - providing that PQC keys fail early, at import time. We can then tell people how (or better still, give them a tool) to strip the PQC encryption subkey(s), leaving a usable v4 key.

It is not just the existence of errors that we must consider, but the nature of those errors and whether the user is empowered to do anything about them. The test suite flags up where the dangers are, but it doesn’t tell us what actually happens in a real usage scenario.

> As a single data point, we know that Github uses an implementation
> derived from Google's OpenPGP implementation for Go (which aiui GopenPGP
> is also derived from).  Assuming the test results for GopenPGPv2 hold
> for x/crypto/openpgp, adding a PQC encryption subkey to a v4 key would
> break Github's signature verification.

I just tried to add the v4 ML-KEM test key from draft-pqc-02 to my own GitHub account. It failed at import time saying:

"We got an error adding your GPG key. Please verify the input is a valid GPG key.”

IMO this is an ideal failure; since keys can only be added or updated manually by the key owner, people should know (or be able to easily find out) whether their own key is PQC-enabled, and how to un-PQC it. And if not, they can google the error message and get some nice person on stack overflow (volunteers, anyone?). I therefore believe GitHub is not a blocker.

(As a contrasting data point, I performed the same test in MacGPGTools. It imported cleanly, and shows a greyed out “Algorithm_105” subkey - otherwise the key appears quite usable. It will happily import and export the test key without errors or data loss.)

A