[openpgp] Re: Key Flags subpacket interpretation question

Thanks for the details and the references.

I've been developing & maintaining a PGP implementation for iOS (recently
added updates for RFC 9580 V6 keys/sigs) for about 14 years and the Key
Usage/KeyFlag stuff has always been a little complicated in practice.

-Wyllys


On Fri, Nov 7, 2025 at 10:53 AM Andrew Gallagher <andrewg=
[email protected]> wrote:

> On 07/11/2025 15:10, Wyllys Ingersoll wrote:
> >
> > What if there are multiple UIDs with signatures that have differing key
> > usage sub-packets - how should the primary key usage be determined in
> > that case?
>
> The primary UID is the User ID packet whose most recent
> self-certification contains a Primary User ID subpacket. Key preferences
> on the primary UID apply to the primary key itself.
>
> Now, there are edge cases such as what if (none|more than one) of the
> most-recent-self-certs contain a Primary User ID subpacket. If there is
> only one UID then that's the primary UID by default. Otherwise, I'd
> suggest sorting the candidate primary UIDs by most-recent-self-cert
> creation date, and taking the most recent of those.
>
> So for example, if there are three User ID packets A B C, each with
> self-certification signatures A1 A2 A3 B1 etc.:
>
> A : A1 A2 A3
> B : B1 B2
> C : C1 C2
>
> Then:
>
> 1. Consider only the most-recent self-certifications A3, B2, and C2.
>
> 2. IFF one or more of them have Primary User ID subpackets, then throw
> away the ones that don't.
>
> 3. If there is more than one remaining, take the most recent.
>
> That self-certification both identifies the primary UID and contains the
> primary key preference subpackets. It's not guaranteed that this is
> always what the owner or their implementation intended, particularly if
> you need step 3 to decide between them, but it gives a reasonable and
> unambiguous result that is actionable.
>
> > Implementation code that follows the rules for applying key usage
> > quickly gets pretty complicated. V6 simplifies it a little with the
> > Direct Key signature, though.
> Yes, v4 UID logic is a can of worms...
>
> A good reference for this kind of high-level beyond-the-RFCs guidance is
> the OpenPGP for Application Developers guide at [1], which is thoroughly
> researched and very readable. Beyond that, you're in the realm of "there
> is no general consensus" and I'd point you in the direction of the draft
> document at [2] for some collected thoughts (with the caveat that this
> is WIP and different implementers disagree on quite a few details). And
> if even this doesn't answer your questions, please let me know and I'll
> add it to the (ever increasing!) list...
>
> A
>
> [1] https://openpgp.dev/book
> [2]
> https://datatracker.ietf.org/doc/html/draft-gallagher-openpgp-signatures
>
> _______________________________________________
> openpgp mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]