Subject: OpenPGP public key packet format

From: [email-masked]
Date: Mon, 8 Apr 2002 15:30:08 -0500

From: John Dlugosz

I have a couple questions...

First, it seems that there are two utterly different version systems going
on.  The "old packet" and "new packet" format allows more packet types in
the new format, but otherwise doesn't affect the content, since the Version
byte in the Type 6 (etc.) packet specifies Version 4 or 5.  So NAI's
implementation (son of original PGP) uses old packets for "backward
compatibility" with v2.6, but then uses a Version 4 Public Key packet which
didn't exist before PGP 5.0, so using the older packet header is pointless.
What's the deal here?  I'm supposing the real reason to use old packet
header is to save a byte, in cases where they can be used (tags < 16).

Second, how are the public key proper and the signing key specified?  I'm
guessing that the key directly encoded in the Tag 6 is the signing(only)
key, and all subkey packets are for public message keys.  The RFC says that
the sign/encrypt only types for RSA are no longer used, but rather flags in
the signature packet is used.  I see the following: Public Key (tag 6),
User ID, Signature, User ID, Signature, Public Subkey, Signature.  I have
two self-signed ID's (different email addresses), so I don't know what the
third one is for.  I also suppose that although packets are not nested but
sequential, the "applies to" is implied as a hiararchy?  That is, the sig
applies to the previous ID?

Anyway, with multiple signatures, does each one specify how the key is used
in addition to saying "I vouch for him", and how do you make sure they all
agree?  Can someone clarify this, please?

What I'm doing:  I'm using OpenPGP in a system, and want to specify exactly
which packets should be used, as the program may be limited to this.  Also,
want to make sure I get it right when manipulating these files.

--John

---

From: "Hal Finney" <[email-masked]>
Date: Mon, 8 Apr 2002 14:06:14 -0700

> header is to save a byte, in cases where they can be used (tags < 16).

If you're not interested in backwards compatibility with PGP 2, you can
use the new format packet tags.  If you require backwards compatibility,
you must use the old format tags and only V3 RSA keys.  If you're asking
why the commercial PGP versions use old format tags with V4 DSA keys,
it was in the hope that 2.6.2 could still parse the packets in terms of
their lengths, and skip over their unrecognizable contents.

> applies to the previous ID?

Yes, there is an implied hierarchy.  This is illustrated in section 11.1
of the RFC.

> agree?  Can someone clarify this, please?

For the subkeys, the key usage flags subpacket can go in the subkey
signature.  For the top level key, probably the best place is in the
self-signature on all the userids.  I think the commercial PGP versions
look specifically in the self-sig on the primary userid.

The commercial versions of PGP do not support signature sub-keys.

Hal Finney

---

From: [email-masked]
Date: Tue, 9 Apr 2002 10:01:32 -0500

From: John Dlugosz

========
======

Thanks.

In the diagram in 11.1, what are the "Direct Key Self Signatures" that come
before the first User ID?

Note that the commercial PGP lets me change which ID is the "primary".  So
if it's looking there, it must be on all of them, and when adding another
ID it must be consistant with what's gone before.  I wonder, though, if
programs just assume that the main key is for signing, and the first
current subkey is for encrypting?  In the case of DSA and the deprecated
RSA-sign-only types, it is clear that the main key can only be used for
signing, without the need for such a record.