Subject: [openpgp] Subkeys of Subkeys

From: Paul Schaub <[email-masked]>
Date: Mon, 20 Sep 2021 16:10:06 +0200

Hey!

RFC 4880 states, that subkeys need to have a signature by the "top
level" certification key
(https://datatracker.ietf.org/doc/html/rfc4880#section-5.2.1, subkey
binding signature):

>        This signature is a statement by the top-level signing key that
>        indicates that it owns the subkey.
Now I would like to know, whether this rules out the possibility that a
subkey itself may have a subkey. Allowing for such constructions would
be interesting for per-device keys in multi-device settings:

An Account Key Alpha owns two Device subkeys A and B, which in turn own
encryption and signing subkeys aE,aS and bE,bS.

Revocation and Expiration could work as usual (revocations/expirations
on higher level keys affect lower-level keys, not the other way round).

I see no obvious issues which might prevent this, apart from the
ambiguous definition quoted above.
Has anyone already experimented with such constructions? If so, did you
encounter any issues which would need to be taken into consideration?

Paul

---

From: Justus Winter <[email-masked]>
Date: Tue, 21 Sep 2021 13:35:00 +0200

Hi Paul :)

Paul Schaub <[email-masked]> writes:

> Allowing for such constructions would be interesting for per-device
> keys in multi-device settings:

Yes, we'd like to improve multi-device support using per-device keys as
well.

> encounter any issues which would need to be taken into consideration?

We considered it, and I talk (see [0] and [1]) about that in the context
of bringing forward-secrecy to OpenPGP (see also [2] if you are into
that).  We have also constructed a test vector [3], but unsurprisingly,
no implementation supports that [4].

0: https://sequoia-pgp.org/talks/2018-08-moving-forward/moving-forward.pdf
1: https://www.youtube.com/watch?v=an6oYjikAPY
2: https://gitlab.com/sequoia-pgp/openpgp-dr/-/tree/wip-openpgp
3: https://gitlab.com/sequoia-pgp/weird-keys#cert-subkeyspgp
4: https://gitlab.com/sequoia-pgp/weird-keys#results

Justus

---

From: Paul Schaub <[email-masked]>
Date: Tue, 21 Sep 2021 13:51:38 +0200

Hey Justus,

That test vector looks exactly like I would imagine it. It's a bummer
that there is no support in applications though. My library is able to
generate keys in this form (with some trickery) but cannot yet handle
them correctly.

What must happen so that a future revision of the specification
explicitly allows this behavior? Would it make sense to specify this
usecase explicitly?

Paul