[openpgp] Re: Key Flags subpacket interpretation question

>
>
> The specific use case here is when a user needs to select a UID for
> sending an encrypted message via email (they choose based on UID/email, not
> KeyID/Fingerprint).
>
> If a key has multiple UID packets and they each have different key usage
> flags, then only a subset of those UIDs can be used if you base the
> decision solely on the key flags associated with that particular UID.
>
> However, as Andrew points out, the key usage on the UID only applies to
> the primary key in the certificate (considering only V4 keys for now) that
> signed the UID packet.  If the certificate has a subkey with encryption
> enabled in it's subkey signature, then that subkey could be used to encrypt
> a message to any of the UIDs and the application could then present all of
> the UID email addrs as options regardless of their individual key flags.
>
> This is where it becomes a gray area - if there are valid subkeys that
> have encryption flags set but the UID selected says it is only good for
> sign/cert, should an implementation be able to encrypt a message to that
> UID with a valid subkey ?
>
>
> Hmm. Possibly I don't fully understand the question, but given that the
> key usage flags on a user ID apply solely to the primary key that signed
> that user ID (agreed), then they aren't relevant to the subkeys, no? So
> long as the user ID key usage flags (the flags pertaining to the primary
> key) allow for certification (i.e. it's allowed to have subkeys at all),
> then any subkey that the primary key certified should be usable to whatever
> extent *it's* key usage from the binding signature says.
>
> Given your example above, any otherwise-valid (not expired, revoked, etc)
> subkey with the encryption flag set should be usable.
>
> Daphne
>
>
Thanks. That was my thinking also.

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]