[openpgp] Re: Primary Key Binding sigs on authentication sub keys

Andrew Gallagher <[email protected]> Wed, 22 Jan 2025 17:01:42 +0000

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

Hi, Daniel.

On 22 Jan 2025, at 16:40, Daniel Huigens <[email protected]> wrote:
> 
> we could also consider
> deprecating authentication subkeys entirely, and say that an application
> that (for some reason) wants to do authentication using OpenPGP, should
> use a dedicated key/certificate, and just use a normal signing (sub)key?

I think it’s a good idea to maintain the domain separation between data signing and authentication, since authentication typically signs over a short-lived challenge rather than a long-lived message. For example I can imagine a future scenario where it would make sense to have a post-quantum signing subkey (for robustness) together with a traditional authentication subkey (for compatibility).

In addition, authentication subkeys are widespread in the wild. The fact that they don’t have a specified OpenPGP signature mechanism hasn’t stopped people from using them, so surely it is better to regularise this usage pattern than deprecate it?

On a broader note, IMO we should bear in mind that OpenPGP has not historically been a strictly-defined or strictly-obeyed specification, and so discrepancies between the language of the specs and established practice crop up on a regular basis - which should not be surprising considering its organic history. I’m therefore not convinced that a literalist reading of the specs is always helpful.

A

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 833 B)