5 May 2009 06:05
how to specify "trust no signatures over hash X from this key"?
Daniel Kahn Gillmor <dkg <at> fifthhorseman.net>
2009-05-05 04:05:31 GMT
2009-05-05 04:05:31 GMT
As i'm thinking about hash function transitions right now, it occurs to me that i'm not sure how to specify something like "The holder of this key will never issue signatures using digest algorithm $foo" In RFC 4880, section 5.2.3.8 the digest algorithm preferences subpacket says something similar: Message digest algorithm numbers that indicate which algorithms the key holder prefers to receive. Like the preferred symmetric algorithms, the list is ordered. Algorithm numbers are in Section 9. This is only found on a self-signature. But this is semantically something fairly different from stating what kind of use the keyholder expects to pursue. Consider the case where a user has in the past made and published MD5-based signatures, and no longer believes that hash algorithm is secure for the purposes used (or if you like, think into the near future, and imagine the same situation with SHA1). It seems to me that it would be useful to have a way that a keyholder could explicitly state "I no longer make signatures over digest X. Please consider any signatures from this key using digest X to be invalid." This does lead to the possibility of an explicit "impedance mismatch", where Alice says "I never issue MD5, SHA1, or RIPEMD160 digests" and Bob says "I prefer to receive only SHA1, RIPEMD160, or MD5 digests" -- in this case, Alice's key is useless to Bob. But this impedance mismatch exists implicitly anyway, if these are the actual policies. It seems like it would be useful to know that the conflict exists at that level.(Continue reading)
RSS Feed