Subject: bis04: revocation key nits

From: David Shaw <[email-masked]>
Date: Wed, 17 Apr 2002 20:49:18 -0400

Hi everyone,

I'd like to raise two items for possible inclusion in bis05.  These
came up while implementing designated revoker functionality in GnuPG.

The first item is that there is no way to revoke a 0x1F signature.
Since the designated revoker information is contained in an 0x1F
signature, this means that once a user designates a designated
revoker, the user cannot later undo the designation if circumstances
change.

I'd like to request a new signature class to indicate a 0x1F
revocation or an expansion of the meaning of one of the existing
revocation signature classes to include 0x1F signatures.

The second item is one I raised in February.  Briefly, the draft
indicates that a designated revoker is allowed to issue three types of
revocations: key revocations (0x20), subkey revocations (0x28), and
certification revocations (0x30).  The problem happens if a user is
both a designated revoker for someone who has signed a given key, as
well as a regular signer for the same given key.  In this case, there
is no way to tell the difference between a certification revocation
issued by the user in his capacity as designated revoker, and a
certification revocation issued by the user in his capacity as
himself.

For example, take Alice, Bob, and Charlie.  Bob is Alice's designated
revoker.  Alice and Bob have both certified Charlie's key.  Now Alice
asks Bob to revoke her certification of Charlie's key.

Since both Alice and Bob have certified Charlie's key, and the format
of the certficate revocation (0x30) that Bob issues is the same
whether he is acting for himself or acting as Alice's designated
revoker, the OpenPGP program has no way to tell which certification is
being revoked: is it Bob's or is it Alice's?

I don't know what the best solution for this is.  Probably the
simplest solution is to only allow designated revokers to issue key
revocations (0x20 and possibly 0x28) and not 0x30 cerfication
revocations.  Michael Young suggested a "revocation target" signature
subpacket for use in revocations.  That would work as well.

For what it's worth, neither PGP or GnuPG currently allow designated
revokers to issue 0x28 subkey or 0x30 certification revocations.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

---

From: Jon Callas <[email-masked]>
Date: Wed, 17 Apr 2002 18:13:34 -0700

>revocation signature classes to include 0x1F signatures.

It is the intent of the designated revoker feature that it cannot be
revoked. Otherwise it's too hairy for words.

Here's a scenario: Suppose Alice is your designated revoker. You discover
that your key is being used by persons unknown for purposes you don't
approve of -- oh, like spending your money. Let's also assume that you no
longer have the secret key (let's say your laptop was stolen).

You visit Alice, explaining the problem, and she generates a revocation for
your certificate. After all, that's why she's your revoker. Alice sends it
to the world. Or you send it to the world for Alice.

The next day, a merchant cashes another bogus check. You call up the
merchant and ask, "What the heck are you doing? Didn't you see Alice's
revocation of that key." The merchant replies, "Yeah, but I also have a
revocation of Alice's revoker status dated April 1, 1999."

How do you revoke your key if the revocation can be revoked? If your key is
compromised, the person who has it can do anything they want, including
revoke your revoker. The designated revoker might as well not be there if
it's not irrevocable. Now it's true, we also have an irrevocability
subpacket. But nonetheless, it can't be revocable.

	Jon

---

From: David Shaw <[email-masked]>
Date: Wed, 17 Apr 2002 22:40:14 -0400

> >revocation signature classes to include 0x1F signatures.

[..]

> subpacket. But nonetheless, it can't be revocable.

Ah, excellent point.  Do you think it is still worth (for
completeness, if not for the specific example of designated revokers)
having a way to revoke a 0x1F signature?

As for designated revokers in GnuPG, I'll do what PGP does and include
a nonrevocable subpacket with the 0x1F signature to remove any
ambiguity.

David