[openpgp] Re: Key Flags subpacket interpretation question

> On Nov 7, 2025, at 10:53 AM, Andrew Gallagher <[email protected]> wrote:
> 
> On 07/11/2025 15:10, Wyllys Ingersoll wrote:
>> What if there are multiple UIDs with signatures that have differing key usage sub-packets - how should the primary key usage be determined in that case?
> 
> The primary UID is the User ID packet whose most recent self-certification contains a Primary User ID subpacket. Key preferences on the primary UID apply to the primary key itself.
> 
> Now, there are edge cases such as what if (none|more than one) of the most-recent-self-certs contain a Primary User ID subpacket. If there is only one UID then that's the primary UID by default. Otherwise, I'd suggest sorting the candidate primary UIDs by most-recent-self-cert creation date, and taking the most recent of those.
> 
> So for example, if there are three User ID packets A B C, each with self-certification signatures A1 A2 A3 B1 etc.:
> 
> A : A1 A2 A3
> B : B1 B2
> C : C1 C2
> 
> Then:
> 
> 1. Consider only the most-recent self-certifications A3, B2, and C2.
> 
> 2. IFF one or more of them have Primary User ID subpackets, then throw away the ones that don't.
> 
> 3. If there is more than one remaining, take the most recent.
> 
> That self-certification both identifies the primary UID and contains the primary key preference subpackets. It's not guaranteed that this is always what the owner or their implementation intended, particularly if you need step 3 to decide between them, but it gives a reasonable and unambiguous result that is actionable.
> 
>> Implementation code that follows the rules for applying key usage quickly gets pretty complicated. V6 simplifies it a little with the Direct Key signature, though.
> Yes, v4 UID logic is a can of worms...

There is also the language in 5.2.3.10 about enforcing self-signature subpackets as narrowly as possible. Using that argument, you might even argue that the key usage flags (like cipher algorithm preferences) are dependent on which user ID you used to find the key (though if you found the key via key ID, you're right back in the which-is-primary question).

Daphne


_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]