[openpgp] Re: on discarding Literal Data Packet metadata [ was: Analysis document]

Andrew Gallagher <[email protected]> Mon, 14 Jul 2025 11:59:05 +0100

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

On 14 Jul 2025, at 07:25, Falko Strenzke <[email protected]> wrote:
> I think the right path would be to first upgrade them to an optional security mechanism (i.e., a hashed subpacket used by the verifier if present). At the same time those fields might be marked as deprecated (requiring that deprecation is supported by the commonly used CLI tools and libraries).

I think you make a good point here - a critical subpacket would require choreography (all receivers would have to be upgraded before any producers), and so would not be an opportunistic upgrade. Whereas a non-critical subpacket would be strictly no worse than the status quo.

> I think an important question that is underlying these considerations is who is the real OpenPGP user base. I don't think it is just the few F/LOSS email clients, packet managers and backup tools. In my experience, OpenPGP is used in proprietary industry applications.

Agreed, we should not expect to ever definitively know who the OpenPGP user base is. Without widespread telemetry, which would go against everything OpenPGP stands for, we rely on self-reporting and membership in groups such as this one. And it’s not reasonable IMO to require that everyone pay attention to IETF WG discussions as the price of having their particular use case supported. That doesn’t mean we should support every obscure corner case forever, in case it breaks some hypothetical workflow somewhere, but reasonably obvious (and low-hanging) cases like this are worth the effort IMO.

If there is concrete interest in implementing such a scheme, I would be willing to revive the draft…?

A

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 833 B)