[openpgp] Re: certification with Persistent Symmetric Keys (PSKs)?

[Heiko Schäfer <[e-mail]>]

Hello dkg, Andrew, all,

as an implementer, I would much prefer sticking to the current, very 
constrained grammar for PSKs.

The different mechanics of PSKs cause additional complexity and require 
additional API surface.
The current draft text limits this additional complexity to the layer of 
individual packets.

At that layer, additional complexity is unavoidable: PSK packets perform 
a different class of operations than asymmetric key packets.
They require additional parameters for all operations except PKESK 
decryption, compared to the analogous asymmetric operations (password 
unlocking of secret key parameters for all operations, as well as an 
RNG, and AEAD mode selection for both "producing" operations).

Adding signatures to construct a "composed PSK-based transferable secret 
key" would mean that additional layers of OpenPGP implementations would 
need added API surface and business logic.

In some sense, associating signature packets with a PSK seems like a 
natural extension, of course. And it would be cheap to write into the draft.

It would have a non-trivial cost for implementations, though.
I'm currently extremely unconvinced that the practical benefits would 
outweigh this cost.


For the specific point that dkg raised: If we want to allow PSKs to 
issue identity certifications, I would suggest that we add language that 
allows applications to consider a PSK implicitly certification-capable, 
even in the absence of a direct key signature that marks them as such.

Thanks,
Heiko


On 8/29/26 6:53 PM, Andrew Gallagher wrote:
> On 28/08/2026 22:02, Daniel Kahn Gillmor wrote:
>>
>> On the other hand, with no key usage flags subpacket (because no
>> self-signature, and because it can't be a subkey) it can't be marked as
>> "certification capable".  So it doesn't fit super well into the general
>> OpenPGP expectations that keys are marked for their intended use.
> I think this is a good point, and relaxing the constraints to permit a 
> direct key signature over the PSK packet does allow arbitrary metadata 
> to be attached to the key within the TSK specification, whereas 
> without it any metadata would have to be stored outside the spec. I 
> would be generally in favour of this, if there are no obvious 
> downsides...
>
> A
>
>
> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]