Subject: Re: [openpgp] OpenPGPv5 wish list

From: Jean-Jacques <[email-masked]>
Date: Mon, 29 Apr 2013 11:15:32 +0200

Le Mon, 29 Apr 2013 01:17:04 -0400,
"Robert J. Hansen" <[email-masked]> a écrit :

> On 4/28/2013 10:37 PM, Hauke Laging wrote:
> > Other things we IMHO really need notation standards for:
> 
> This really isn't the place for it, guys.  GnuPG-devel is for
> discussion of how to make GnuPG track the standard better; the
> OpenPGP list is for discussion of how to make the standard itself
> better.

Yep, so I switched the thread to the other mailing list.
> 
> > Things I want in the protocol:
> 
> I'll make my own wish list simple:
> 
> I don't want *anything* new included in the standard unless there
> exists at least one user who says, "the absence of this feature is a
> showstopper for me and is blocking my adoption of GnuPG."  This user
> needs to be able to show a real-world use case and be willing to
> volunteer to run trials in a real-world environment.
> 
> No real-world user?  No feature.

So I answered because I really "need" such feature in OpenPGP for
real-world :

2) What is the key used for?

And I see at least 4 purposes :
 - To authenticate itself through TLS  [RFC6091]
 - Maybe To sign other certificates (subkeys on smartcard issues)
 - To authenticate through HTTP (gpgauth or
   https://github.com/Open-UDC/open-udc/blob/master/docs/HTTP_OpenPGP_Authentication.draft.txt)
 - To sign an OpenUDC transaction.

I work especially on the 2 last purposes. And having the possibility
for the owner to set descriptions, or more flags on its (sub)keys inside
its OpenPGP certificate, would be a more elegant solution than some
workaround we have to manage.

> 
> That's my own wish list, and I desperately hope it comes to pass.  :)
> 
We have to better organize A wish list, or it will be a mess to
identify their elements. :-)

---
jbar.

---

From: ianG <[email-masked]>
Date: Mon, 29 Apr 2013 12:40:14 +0300

> workaround we have to manage.

Some comments from my experience/perspective, only.  In my work I have 
done this by using pgp's comment field aka uid.  Here's some:

$ gpg -k | grep uid

uid                  Iang [certification] (Africa-2012) <[email-masked]>
uid                  Iang [contract] (lowsec-PIZZA-only) <[email-masked]>
uid                  Systemics [operator] (Africa-2012) <[email-masked]>
uid                  Systemics [server] (Babba-2012) <[email-masked]>
uid                  Systemics [receipt] (Babba-2012) <[email-masked]>
uid                  Systemics [receipt] (offa-20130101) <[email-masked]>
uid                  Systemics [server] (offa-20130102) <[email-masked]>

In my software I use the [tag] for the purpose, the (text) as a human 
comment, and everything else as the name of the keyholder.  You could do 
whatever tho.

Perhaps more on point, I do not want the OpenPGP system to provide me 
with bits that allow me to set purpose or anything else, because OpenPGP 
is too low-level.  My designed claims like "this is an operator key" are 
too involved in the business layer to be foisted onto anyone else.  The 
history of key-bits being used for human claims suggests this is a fast 
way to failure.  E.g., non-revocation and the infamous 
you-must-understand-me bit.

I don't know if this logic applies to anyone else.  But if it did, 
hypothetically, I might record your claims in my key uids as such:

uid                  Iang [HTTP-auth] (social-networks) <[email-masked]>
uid                  Systemics [UDC-agent] (Black-2012) <[email-masked]>

iang