Subject: Re: Signature calculation language

From: [email-masked] ("Hal Finney")
Date: Tue, 11 Oct 2005 15:25:00 -0700 (PDT)

David Shaw writes:
> Wondering - should the embedded 0x19 signature be a MUST?  Lacking a
> 0x19 allows the signing subkey to be "stolen" onto another primary
> key.

To remind readers, the 0x19 signature is issued by signing subkeys on
top-level keys, so that we have two-way binding.  The top key signs the
subkey and the subkey signs the top key, so each key agrees that they
belong together in a pair.

The problem is that if it is not a MUST, someone who does create
such a 0x19 back signature to bind his subkey is still at risk of it
being stolen.  The thief would bring just the subkey over and put a new
signature on it by his top key, and there would be no sign of the 0x19
signature the victim had created to try to stop this theft.  There would
be no 0x19 signature on the new key, but if it is not a MUST then we
might have to assume that this was just a choice by the key holder not
to create one.

So it does seem like it must be a MUST in order to be an effective
deterrent.

One possible problem is if there is any substantial set of signing subkeys
in use that don't have the 0x19 signature.  Signatures issued by those
keys might become invalid.  I don't think we have any from pgp.com,
we did not previously support signing subkeys.

Hal Finney

---

From: [email-masked] (Daniel A. Nagy)
Date: Wed, 12 Oct 2005 02:23:24 +0200

> we did not previously support signing subkeys.

I have encountered only one signature subkey so far, but I do intend to use
signature subkeys in the future myself. I agree that signature theft is a
very serious issue, and mandating 0x19 signatures is necessary to prevent
it.

Signature subkeys currently in use are not that much of a problem, because
the owners can always create the missing 0x19 signature. If they don't, it's
in everybody's interest (including their own) that the signatures become
invalid.

I actually wanted to do a survey of public keys for algorithms, key sizes,
subkeys, etc. for a long time. What I really want to know is what algorithms
and key sizes are used for certification, encryption and document signature,
and what proportion of users use subkeys.

If there's additional interest for such a survey, please let me know: it
will provide me with the additional motivation I need to actually carry it
out. Most of the software has already been written, but it's a horrible
processor hog of a task, estimated to keep a server busy for several hours.
As a side benefit, I could email all known signature subkey owners about
signing their subkey both ways. But that can only happen when major
implementations (PGP and GPG) can actually do it.

Also, there's a significant number of keys corrupted by keyservers that
can't handle multiple subkeys correctly. While natural in some way, it still
amazes me how much worse the quality of keyservers are compared to other
OpenPGP software.

-- 
Daniel

---

From: David Shaw <[email-masked]>
Date: Tue, 11 Oct 2005 22:50:34 -0400

> we did not previously support signing subkeys.

GPG supports signing subkeys, and there are a number of them in use.
(A number, it should be said though, that is utterly dwarfed by the
number of people using their primary key as their signing key.)

I am concerned about the users of signing subkeys, so I have a
transition planned for GPG.  GPG has offered 0x19 backsigs as a
build-time option for a while now.  As of the next release (1.4.3),
backsigs are on by default so all new signing subkeys have them.  At
some point in the future (after more subkeys get backsigs), GPG will
start complaining if it does not see a backsig.  At some point even
further, GPG will start treating signatures issued by a signing subkey
without a backsig as invalid, but there will be a way to tell GPG to
ignore the missing backsigs for backwards compatibility.

I think such a transition in GPG and other programs that support
signing subkeys is a reasonable solution for the existing signing
subkeys out there, and it shouldn't impact doing the right thing in
the standard for future use.

I support making 0x19 backsigs a MUST.

David

---

From: Werner Koch <[email-masked]>
Date: Wed, 12 Oct 2005 15:55:09 +0200

> I support making 0x19 backsigs a MUST.

I concur with David.  I am actually a heavy user of signing subkeys
because they allow to keep the primary key offline.

Salam-Shalom,

   Werner