[openpgp] Re: PQC requires urgent semantic cleanup

Hey Andrew, list,

On 11/21/25 1:54 PM, Andrew Gallagher wrote:
> Perhaps the first "bite" should therefore be Section 9 (Time Evolution 
> of Signatures)? Does it make sense to separate this from the rest of 
> the document? Would we have to also include some or all of Section 8 
> (Revoking signatures and keys)?

Sounds good. Combining Sections 8 and 9 makes sense to me.


>> Clarifying semantics questions that the Interop Test Suite already 
>> touches on could be a natural starting point.
>> Once those semantics are clarified, maybe we can iteratively come up 
>> with additional test cases that cover more testable semantics questions.
>
> Perhaps we should draw up a list of tests where implementations 
> disagree, and identify which of those inconsistencies can be 
> attributed to unclear specifications?

I've gone over the Interop Test Suite and identified three categories of 
semantics questions for which I'm unsure if WG consensus has been 
determined. I've opened a PR with a commit for each topic, to point out 
the relevant test scenarios in the interop suite.

https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/merge_requests/195


For further discussion, the semantics questions raised in these commits are:

1. "Semantics: Unclear use of signature expiration time"

These are cases where a "signature expiration time" is expected to cause 
the validity of a signature to end. As far as I can tell, it 
washistorically the intent of that subpacketto be applied only to 
certification signatures - a more general application to other signature 
types is atype of behavior that GnuPG introduced at some point, for 
reasons that are unclear to me.

To take one example, it is unclear what added utility a Signature 
Expiration Time subpacket brings when contained in a Primary Key Binding 
signature.

2. "Semantics: Unclear if soft revocations are permanent"

These are cases in which a primary key or subkey is "soft" revoked at 
some point in time (with a "Key Revocation" or "Subkey Revocation" 
respectively). That revocation is followed by a newer "Direct Key" or 
"Subkey Binding Signature", respectively.

It's unclear to me whether there is consensus thatsuch a subsequent 
signature is supposed to "override" the revocation signature.It is 
generally accepted that "hard" revocations should take priority over 
later signatures. It would be equally reasonable to interpret "soft" 
revocations as taking priority over subsequent signatures.

The RFCs RECOMMEND that signatures with similar semantics should be 
prioritized according to creation time, but it is not clear whether this 
applies across distinct signature types, such as between non-revocation 
and revocation signatures over the same material.

3. "Semantics: Unclear if historical self-signatures need to be available"

These are cases where a subkey only has binding signatures that were 
issued later than its key creation time, and the validity of data 
signatures at a reference time that predates these "newer" bindings is 
checked.

It's unclear to me whether a subkey requires a complete set of 
historical self-signatures in order to be considered valid for 
historical data signatures that it issued.

This case touches particularly strongly on the interaction between 
"minimization" of self-signatures and validity, as raised by Andrew.


Thanks,
Heiko

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]