[openpgp] Re: Specifying OpenPGP file extensions (and MIME type)?

[Daniel Kahn Gillmor <[e-mail]>]

No hats on for this message.

On Wed 2024-12-04 16:50:43 +0000, Daniel Huigens wrote:
> Since the name of the standard is OpenPGP, I think .pgp is fine as a
> filename, since it can also just be considered an abbreviation of
> that.

I agree with this.

> Beyond a filename, it would also be nice to have a MIME type for PGP
> messages. RFC3156 does define application/pgp-encrypted, but uses it
> only for the "Version: 1" control text, while using
> application/octet-stream for the actual encrypted data.

right, the Media type "application/pgp-encrypted" is taken, meaning this
"control" part of an RFC3156-formatted message. So it probably shouldn't
be used for the things that we're talking about here.  (as an aside, i
think the PGP/MIME specification of this "conntrol" part is remarkably
unhelpful; as an implementer, i have no idea what to do if the contents
are anything other than "Version: 1", so it's just meaningless
boilerplate in every message)

I know that /etc/mime.types as shipped with debian isn't the same thing
as the formal IANA Media Type registry (which doesn't say anything about
filename "extensions", but these are what i've got on my system:

0 dkg@bob:~$ grep pgp /etc/mime.types 
application/pgp-encrypted			pgp
application/pgp-keys				asc key
application/pgp-signature			sig
0 dkg@bob:~$

those three media types are defined in RFC 3156.  Note that the mapping
of the "pgp" filename extension does appear to imply a reuse of the
"application/pgp-encrypted" media type for encrypted messages *and* the
"control" part.  That seems problematic.

> Perhaps we could define application/pgp-message, to cover both
> encrypted messages and inline-signed messages, for example?

Is there a reason to use the same media type for both kinds of messages?
If we're defining media types, why not define two distinct ones: one for
an inline-signed message and one for an encrypted message?

I know there has been talk of refining/constraining the OpenPGP message
grammar.  It seems to me that any such work would be a reasonable place
to try to define a clean set of media types.

   --dkg