[openpgp] Key Flags subpacket interpretation question

Wyllys Ingersoll <[email protected]> Thu, 6 Nov 2025 17:29:03 -0500
Newsgroups gmane.ietf.openpgp
Message-ID <CAHRa8=VXE5wqTULjs9Yza=LPzxeZa52yFzvZymBC_uJdqK8iEg@mail.gmail.com>
I have an implementation/interpretation question regarding the KeyFlags
signature subpacket for V4 (or V6) keys and signatures.

I have someone's public key certificate which contains a primary key, a
subkey and a single UseriD.

There is a subkey binding signature on the subkey with a KeyFlags
sub-packet that indicates that the key is good for encryption and signing.
There is a Positive UID signature on the UserID packet that includes a
KeyFlags sub-packet that says it can only be used for signing/certification.

Should this key be accepted and usable for encrypting a message to the
email specified in the UserID packet?

The subkey signature says 1 thing but the UID signature says another.  What
is the correct logic that dictates whether or not the key can be used for
encryption (or vice-versa, signing)?

Thanks,
   Wyllys Ingersoll

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]