[openpgp] Re: Review of draft-ietf-openpgp-replacementkey-04

Am 08.08.25 um 01:30 schrieb Andrew Gallagher:
>>
>> That naturally raises the question in how far User IDs matter in the 
>> "key equivalence group" (a term I suggest that could be used in the 
>> draft also). If neither certificate carries User ID packets, trust 
>> transference should clearly be possible (case A). But if both carry 
>> user ID packets with a) partial overlap or b) no overlap at all, is 
>> trust transference also possible? At least for what I mention under 
>> "B) User-ID Trust" above, the case b) seems a bit confusing.
>>
>
> I think we can describe Key Equivalence Groups without referring 
> specifically to User ID packets, but rather to the underlying concept 
> that such packets represent - an identity “claim”. Such a claim can be 
> explicit (there’s a User ID with a self-signature over it), or 
> implicit (I found this in an Autocrypt header). We don’t need to get 
> into such details in this draft, but I think it’s good to keep them in 
> mind when drawing up suitably generic language.

I see the following potential technical problem: Eve has an existing key 
with a single user ID [email protected]. Alice trusts that Eve rightfully 
owns this email address. Now at some point Eve creates a new key and 
sets the Replacement Key Subpackets in both the the old and the new key 
such that there is key equivalence established between them. The new key 
also happens to contain the User ID [email protected]. Will Alice now 
trust that Eve also controls this email address?

If so, this would mean that Eve can use the RKS to gain cryptographic 
control over the email communication of other users. I think it is clear 
that his may not happen, but from the contents of the draft and your 
explanations in response to my previous comments, it doesn't become 
clear to me whether and how this problem is avoided.

- Falko

-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email protected]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]