Re: V5 key packet format requirements

[Ian G <[e-mail]>]

Ben Laurie wrote:
> Daniel A. Nagy wrote:

>>1. Exclude creation date from fingerprint and key ID hash computation (and
>>maybe from the key packet, too -- it belongs to the self-signature). This
>>would mean that the key fingerprint and ID depend only on the actual key
>>(key material + algorithm).
> 
> 
> This could be confusing - documents that were signed with a key
> specified like this could retroactively find themselves predating the key.


Why is this important?  The date on the key is
just "there" and isn't of such strength that it
should be stressed overly much.

The dates of importance are the date of signing
(which should be in the signature) and the date
of attesting some meaning to the key for the
purpose of signing documents.  The date of the
key creation would appear to be just some artifact
of the tech.

(And for some things like password-generated keys,
would appear to be a non-date.)



> 
>>2. Scrap encrypted private keys. We already have a symmetrically encrypted
>>container format with sufficient integrity protection, so there is no reason
>>to maintain another one. Just put the unencrypted private key packet into
>>that container, if you need encryption. This will reduce the number of things
>>to worry about and make the security of OpenPGP easier to assess and
>>maintain.
> 
> 
> Yes, please!


Yay!  Less is always better.


iang