[openpgp] Re: OpenPGP WG next steps discussion

Simon Josefsson <[email protected]> Wed, 17 Sep 2025 11:41:45 +0200

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

Daniel Huigens <[email protected]> writes:

> Hi Simon,
>
> We are interested in Key Transparency for OpenPGP, and have shipped
> a version of it: https://proton.me/files/proton_keytransparency_whitepaper.pdf
>
> IMO, what would be most interesting is to do a standardized version
> of this based on the work of the Key Transparency WG.

Interesting, although if I'm not mistaken that is about key transparency
and not about transparency logging of signatures?

Are you (or someone else) also interested in how to commit a PGP
signature into a transparency log, and store the transparency chain
commitment in a PGP extension?

The extension would convey to a recipient that the signature was
committed to some log, and the recipient can also verify
cryptographically this claim.  The extension would carry some
information that can be chained back to the transparency log.

This helps to mitigate the "no hidden release" attack which we have no
way of protecting against with standard PGP today, and I believe it is a
realistic threat vector that would be nice to adress from within PGP.

/Simon

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 1.2 KB)