[openpgp] Re: PQC requires urgent semantic cleanup

Hi Heiko & all,

Thanks for pushing this forward and for making an MR to update the test expectations! As I wrote in the review there, I agree with the last two but not the first one (see below).

On Monday, November 24th, 2025 at 19:43, Heiko Schäfer <[email protected]> wrote:

> 1. "Semantics: Unclear use of signature expiration time"
>
> These are cases where a "signature expiration time" is expected to cause the validity of a signature to end. As far as I can tell, it was historically the intent of that subpacket to be applied only to certification signatures - a more general application to other signature types is a type of behavior that GnuPG introduced at some point, for reasons that are unclear to me.
>
> To take one example, it is unclear what added utility a Signature Expiration Time subpacket brings when contained in a Primary Key Binding signature.

IMHO, this one is in a slightly different category than the other two, because it's not so much that the spec text is unclear (it quite straightforwardly says that the Signature Expiration Time indicates "the validity period of the signature", without restrictions on the signature type), but moreso that the benefits of that are unclear. In other words, here we're arguing about which semantics we want, and whether that matches what the spec says (and perhaps whether that in turn matches the historical intent) rather than how the spec text should be interpreted.

So, unlike the other two categories, these tests do seem to me to be grounded in RFC9580, and IMHO we should at least wait until draft-gallagher-openpgp-signatures is adopted before changing them.

Correspondingly, the text proposed in draft-gallagher-openpgp-signatures-02, namely:

> Key Binding signatures other than self-certifications over v4 Primary User IDs (Subkey Binding signatures, Primary Key Binding signatures, and Direct Key signatures) SHOULD NOT contain Signature Expiration Time subpackets, and any such subpackets MUST be ignored.

..seems to me to introduce a change rather than a clarification of RFC9580.

Furthermore, the first test case changed by the MR, namely of an [expired primary key binding signature](https://sequoia-pgp.gitlab.io/openpgp-interoperability-test-suite/results.html#Primary_key_binding_signatures), passes in all implementations except PGPy and GnuPG.
So, I'm not sure it's worth the churn to change the spec, the tests, and all of those implementations.

I also think it's in fact the simplest way to implement the Signature Expiration Time subpacket, to check it for any signature type unconditionally, rather than letting it depend on the signature type.

So, I would personally in fact prefer not to change that behavior, and take out (or milden) this change in draft-gallagher-openpgp-signatures.
I would be on board with saying that implementations MUST NOT generate Signature Expiration Time subpackets in contexts where they don't make much sense, and perhaps that they MAY be ignored there, but not that they MUST be ignored there.

Best,
Daniel

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]