Subject: Issue with RFC4880 IANA Registrations

From: Derek Atkins <[email-masked]>
Date: Fri, 16 Nov 2007 12:17:12 -0500

Hi,

I've been working offline with the IANA to get the OpenPGP registries
in place and we've hit a snag, so I figured I'd write the working
group to see how we as a WG want to proceed.  The snag appears to be a
missing registry creation task in regards to Notation Data flags.

Section 5.2.3.16 (Notation Data) has the following:

       (4 octets of flags, 2 octets of name length (M),
                           2 octets of value length (N),
                           M octets of name data,
                           N octets of value data)

   This subpacket describes a "notation" on the signature that the
   issuer wishes to make.  The notation has a name and a value, each of
   which are strings of octets.  There may be more than one notation in
   a signature.  Notations can be used for any extension the issuer of
   the signature cares to make.  The "flags" field holds four octets of
   flags.

   All undefined flags MUST be zero.  Defined flags are as follows:

       First octet: 0x80 = human-readable.  This note value is text.
       Other octets: none.

  [snip]

The IANA Considerations section says:

10.2.2.1.  Signature Notation Data Subpackets

   OpenPGP signatures further contain a mechanism for extensions in
   signatures.  These are the Notation Data subpackets, which contain a
   key/value pair.  Notations contain a user space that is completely
   unmanaged and an IETF space.

   This specification creates a registry of Signature Notation Data
   types.  The registry includes the Signature Notation Data type, the
   name of the Signature Notation Data, its allowed values, and a
   reference to the defining specification.  The initial values for this
   registry can be found in Section 5.2.3.16.  Adding a new Signature
   Notation Data subpacket MUST be done through the EXPERT REVIEW
   method, as described in [RFC2434].

There seems to be a disconnect between these two sections.  My reading
of 10.2.2.1 is that there's a registry of the notation names, of which
there don't appear to be any defined in 5.2.3.16.  However there
doesn't appear to be a registry of the "flags", of which there IS a
single entry (0x80) defined in 5.2.3.16.

So did we miss a needed registry or Notation Data Flags?  Or are the
labels in 10.2.2.1 just not the same as the labels in 5.2.3.16 and the
label disconnect is causing confusion?

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Jon Callas <[email-masked]>
Date: Sat, 17 Nov 2007 13:24:02 -0800

Let me take a step back. I think that may bring clarity.

Notations are a name-value pair in a signature, with arbitrary binary  
data allowed as the name and value. (I would use the word "key" as  
that's more traditional in data structures, but that would be  
confusing.) If you allow arbitrary values for names, there's the  
possibility of collisions in names. Hence a registry is desirable.  
This registry is presently null.

We also allowed for an unmanaged space of the form [email-masked],  
for the owners of any example.com domain, and if they step on their  
own feet that's their problem.

There is also metadata. The only metadata we have is the single flag.  
Beyond that flag, no one has thought of any other needed metadata,  
and even that one flag is something we seem to have consensus on, and  
that consensus is that it is more charming than useful. Thus, it  
seems we need a registry for those flags because if we don't, then a  
week from now someone will come up with a brilliant idea that needs  
one. Murphy's Law is like that.

So there are two possible registries: one for the managed space of  
names, and one for extra metadata flags. Does this clear it up?

	Jon

---

From: David Shaw <[email-masked]>
Date: Sat, 17 Nov 2007 16:52:43 -0500

On Fri, Nov 16, 2007 at 12:17:12PM -0500, Derek Atkins wrote:

> there don't appear to be any defined in 5.2.3.16.

Yes.  An existing, but currently empty registry.

> However there doesn't appear to be a registry of the "flags", of
> which there IS a single entry (0x80) defined in 5.2.3.16.

Yes.

> label disconnect is causing confusion?

My take is that, yes, we're missing a registry for the flags.  I
believe it should be an IETF CONSENSUS registry.

David

---

From: Derek Atkins <[email-masked]>
Date: Mon, 19 Nov 2007 09:56:01 -0500

Jon,

> names, and one for extra metadata flags. Does this clear it up?

Based on this (and David Shaw's) response, it sounds like there
is a bug in the document, because we do NOT actually create that
registry of "extra metadata flags" in the IANA considerations section.

I've CC'd Sam on this and I'll talk to IANA to see what we need
to do to correct this oversight.  I hope we don't need a new document
to correct it, but as the RFC has already been published I don't
know what we can do.  Can you actually create a registry in an
errata?

-derek

---

From: David Shaw <[email-masked]>
Date: Mon, 19 Nov 2007 12:11:24 -0500

> know what we can do.  Can you actually create a registry in an

If the errata path doesn't work out, we could publish a brand new
"OpenPGP Notations" document that specifies a notation or two (maybe
formalize the [email-masked] notation into a
standard one).  That document could create the new registry.

David