[openpgp] Primary Key Binding sigs on authentication subkeys

Andrew Gallagher <[email protected]> Thu, 16 Jan 2025 10:12:12 +0000

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

Hi, all.

A recent discussion [1] on the pm/g-c repo raised a question about some of the wording in RFC9580. Section 10.1.5 [2] says:

> Each Subkey packet MUST be followed by one Signature packet, which should be a Subkey Binding signature issued by the top-level key. For subkeys that can issue signatures, the Subkey Binding signature MUST contain an Embedded Signature subpacket with a Primary Key Binding signature (Type ID 0x19) issued by the subkey on the top-level key.

The question arising is: what does “subkeys that can issue signatures” mean? Historically, many implementations (including gnupg) interpreted this narrowly to mean “subkeys with the 0x02 key flag”, and we can see in the SKS dataset that there are a huge number of auth subkeys in the wild without primary key binding sigs.

While it is relatively harmless to add the embedded backsig to new authentication key binding signatures, I believe enforcing this on existing keys is an unnecessary breaking change. It is also not clear what attack this mitigates.

IMO we must clarify this, however there are several options for how to do so:

1. Make the backsig optional on authentication subkeys, e.g. by modifying section 10.1.5 to read “subkeys with the 0x02 flag”.
2. Make the backsig optional on v4 authentication subkeys, but mandatory on v6.
3. Specifically recommend against using backsigs on any auth subkeys.

There may be other options.

IMO it would also be very helpful to spell out the motivation behind the primary key binding signature, so that future spec authors can determine when to require it on novel signature types.

I would be happy to add any agreed language to draft-signatures for future reference. [3]

Thanks,
A

[1] https://github.com/ProtonMail/go-crypto/pull/265
[2] https://www.rfc-editor.org/rfc/rfc9580.html#section-10.1.5-8
[3] https://datatracker.ietf.org/doc/html/draft-gallagher-openpgp-signatures

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 833 B)