Re: [openpgp] PQC signature algorithm selection

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2024-02-27 19:02:18 +0000, Stephen Farrell wrote:
> On 27/02/2024 18:55, Andrew Gallagher wrote:
>> On 27 Feb 2024, at 18:52, Stephen Farrell <[e-mail]>
>> wrote:
>>> 
>>> On 27/02/2024 17:21, Andrew Gallagher wrote:
>>>> IMO a good rule of thumb is BS=NS (broken signature equals no 
>>>> signature).
>>> 
>>> That could well be a reasonable semantic, (it's what DKIM uses), 
>>> but IIUC that'd be a change for openpgp email, or am I wrong?
>> 
>> The subject came up at the last openpgp-email summit, and it seemed
>> to be broadly acceptable.
>
> So it sounds like something worth discussion as part of this
> topic as it would have effects on how one might handle multiple
> sigs, both in this PQC transition case and more generally as
> signing algorithms evolve.

fwiw, the Stateless OpenPGP (`sop`) command-line interface, which many
implementations have adopted for the purposes of interoperability
testing, explicitly follows Andrew's "BS=NS" rule of thumb.

Only valid signatures are emitted, and as long as a single signature is
made from any of the set of acceptable signing keys, the `sop verify`
subcommand will return success.

As the maintainer of that specification, i've heard no objections from
any implementer, nor have i heard any suggestions to change this default
behavior.

>  > How many clients follow this in practice
>  > already is another question of course.
>
> Right. My relatively limited experience is that MUAs do not
> just ignore pgp sigs that fail verification.

Many MUAs that implement any sort of end-to-end cryptographic tooling
are incredibly excited to show the user as many of the gory details as
possible.  This is a UX antipattern.

This antipattern is explicitly discouraged in the "Signature failures"
subsection in draft-ietf-lamps-e2e-mail-guidance.  We should not base
wire format protocol-level decisions on these UX antipatterns, no matter
how widespread they are.  Rather, we need to encourage MUAs to behave
more sensibly.

> (That said, the "I can't open the attachment on your mail" response
> from recipients is by far the most common UI signal I receive when
> signing;-()

☹ This problem with multipart/signed messages has come up repeatedly
over the last several years.  It probably belongs in its own
internet-draft so that we don't keep mixing it into what should really
be distinct discussions.

        --dkg