[openpgp] Re: Key Flags subpacket interpretation question

Thank you, Andrew.

So, in the case I described, the subkey could/should be used for
encrypting, but the primary key cannot. (UID says sign/certify, subkey
signature says enc/sign/certify).

What if there are multiple UIDs with signatures that have differing key
usage sub-packets - how should the primary key usage be determined in that
case?

Implementation code that follows the rules for applying key usage quickly
gets pretty complicated. V6 simplifies it a little with the Direct Key
signature, though.





On Thu, Nov 6, 2025 at 7:35 PM Andrew Gallagher <[email protected]> wrote:

> Hi, Wyllys!
>
> > On 6 Nov 2025, at 22:29, Wyllys Ingersoll <[email protected]> wrote:
> >
> > The subkey signature says 1 thing but the UID signature says another.
> What is the correct logic that dictates whether or not the key can be used
> for encryption (or vice-versa, signing)?
>
> For v4 keys, the key flags subpacket in the most recent self-certification
> over the primary userid apply only to the primary key. For v6 keys it is
> the most recent direct key signature that contains the primary key’s flags.
>
> The key flags on the subkey binding signature apply to that particular
> subkey, for all versions.
>
> Hope that helps,
> A

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]