[openpgp] Re: Review of draft-ietf-openpgp-replacementkey-04

Andrew Gallagher <[email protected]> Tue, 12 Aug 2025 00:18:31 +0100

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

On 8 Aug 2025, at 00:30, Andrew Gallagher <[email protected]> wrote:
> 
>> It seems to me that at the minimum, the draft would benefit from some clarifications what types of trust are supposed to be captured by the trust transference through key equivalance and if / how this relates to the contents of the User-ID packets of the certificates in the equivalence group.
>> 
> 
> I agree, and have been thinking along the following lines:
> 
> * “trust” should be reserved for “ownertrust” and is therefore out of scope of this document
> 
> * The input to the Key Equivalence calculation is whether a particular identity claim regarding a key/certificate is considered authentic, or valid, by the receiving implementation. Whether the claim is explicit or implicit, and whether the claim validity derives from the web of trust, or provenance, or the user Just Said So, should not matter for the purposes of this draft.
> 
> * The output of the Key Equivalence calculation is that any valid identity claim (as determined by the previous bullet point) regarding one member of a Key Equivalence Set is automatically valid for all other (current) members of the Key Equivalence Set.
> 
> I think this would avoid the “trust” minefield entirely. And perhaps we should therefore talk about “Identity Equivalence” instead of “Key Equivalence”?

I have made the above changes to the editor’s copy.

A

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 833 B)