Subject: (fwd) Re: key flags -- what do they mean?

From: Adam Back <[email-masked]>
Date: Tue, 9 Mar 1999 22:25:05 GMT

Thomas Roessler sent me the below interpretation of key flags to
certification in email.  Forwarded to the list with permission.

Comments?

Adam

------- Start of forwarded message -------
Date: Mon, 8 Mar 1999 07:28:46 +0100
From: Thomas Roessler <[email-masked]>
To: Adam Back <[email-masked]>
Subject: Re: key flags -- what do they mean?
References: <[email-masked]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
User-Agent: Mutt/0.96i
In-Reply-To: <[email-masked]>

On 1999-03-08 00:05:51 +0000, Adam Back wrote:

> So the question is does this mean that it is possible to say that a
> key may not be used for certification?

As I read this, the key's owner can say that a key should not be
used for certification (whatever this means), but a CA can't, and a
CA can't make sure the user doesn't change his mind.

Quoting from 5.2.3.2:

   Subpackets that appear in a certification self-signature apply to
   the username, and subpackets that appear in the subkey
   self-signature apply to the subkey. Lastly, subpackets on the
   direct key signature apply to the entire key.

This means that a CA could only make a statement about key usage for
a specific user-id.  Such a statement doesn't make too much sense.

Alternatively, a user could put a statement like this one into a key
self-signature.  Since this self-signature is not part of the
information signed by the CA, it's worthless from the British govt's
point of view - the user could change his mind and generate a new
self-signature.

Additionally, the standard doesn't mandate implementations to
implement the specific signature subpacket we are talking about.  In
5.2.3.1, you can read the following:

   An evaluator may "recognize" a subpacket, but not implement it. The
   purpose of the critical bit is to allow the signer to tell an
   evaluator that it would prefer a new, unknown feature to generate an
   error than be ignored.

   Implementations SHOULD implement "preferences".

Regards, tlr
- -- 
http://home.pages.de/~roessler/
------- End of forwarded message -------

---

From: Jon Callas <[email-masked]>
Date: Tue, 09 Mar 1999 14:49:11 -0800

At 10:25 PM 3/9/99 GMT, Adam Back wrote:
|
|Thomas Roessler sent me the below interpretation of key flags to
|certification in email.  Forwarded to the list with permission.
|
|Comments?
|

I agree completely with Thomas.

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)