Subject: [openpgp] Registration of the 'proof' notation

From: Wiktor Kwapisiewicz <[email-masked]>
Date: Wed, 30 Sep 2020 11:20:08 +0200

Hello,

I'd like to request registration of notation in the IETF namespace (non
suffixed) as a sub-section of 5.2.3.17. Notation Data [0]:

-----------------------------
The 'proof' notation

The proof notation contains a resource identifier that can be verified
as being associated with the OpenPGP key. The identifier SHOULD be in
URI format. This is intended in particular to associate user accounts on
the web. The specifications on how the verification should be performed
is beyond the scope of this document.
-----------------------------

This notation in a user space variant ([email-masked]) is already in
use by several services the biggest of which is https://keyoxide.org/
(developed by Yarmo Mackenbach) and partially documented in
https://metacode.biz/openpgp/proofs

Thank you for your time!

Kind regards,
Wiktor

[0]:
https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-09#section-5.2.3.17

-- 
https://metacode.biz/@wiktor

---

From: "Neal H. Walfield" <[email-masked]>
Date: Wed, 30 Sep 2020 12:22:44 +0200

Hi Wiktor,

Thanks for submitting the proposal.  For the record, I'm against it.

On Wed, 30 Sep 2020 11:20:08 +0200,
> suffixed) as a sub-section of 5.2.3.17. Notation Data [0]:

For those following along at home: Vincent explored this idea of
social proofs for OpenPGP (he called them linked identities) in his
master's thesis.  He submitted two I-Ds describing how to add them to
OpenPGP using User Attributes:

  https://datatracker.ietf.org/doc/html/draft-vb-openpgp-linked-ids-01
  https://datatracker.ietf.org/doc/html/draft-vb-openpgp-uri-attribute-01

Some discussion can be found here:

  http://moderncrypto.org/mail-archive/messaging/2015/001348.html

Without getting into the details, I think Vincent's proposal is good,
and should be the preferred way forward assuming we want this feature.
And, I think this feature is desirable.

> https://metacode.biz/openpgp/proofs

For the record, Hagrid also supports them, e.g.:

  https://keys.openpgp.org/[email-masked]

The use of the proof notation is a nice hack given the state of the
ecosystem.  In particular, AFAIK, no OpenPGP implementation outside of
Open Keychain supports adding social proofs / linked identities to an
OpenPGP Certificate, but most do support adding notations even if that
support is a bit clumsy, cf. the "Adding proofs" section in:

But, that doesn't mean that this hack should be standardized
particularly given that it is using existing OpenPGP mechanisms
(notations) exactly as intended.

These are several reasons why I prefer the User Attribute approach:

  - Since the notations are attached to a User ID self signature, it
    is not possible for a third party to certify a linked identity in
    the usual manner.  For instance, I think it would be useful to
    create a User Attribute for a social media handle or some service,
    and then have someone cerify that identity.  We could embed a URI
    in a User ID packet (e.g., twitter://@nwalfield,
    ssh://walfield.org), but this further complicates parsing User ID
    packets, which means that OpenPGP applications are less likely to
    make use of this information.

  - Notations change the semantics of certification.  When Alice
    certifies that "Bob <[email-masked]>" controls the Certificate
    0xBBBB, is she also certifying Bob's linked identities?  The
    notations are stored on the User ID's self signature and not on
    the User ID packet, but...

  - Traditionally, OpenPGP has had one identity per artifact.  This is
    nice, because it means that it is possible to only publish
    relevant information.  For instance, the WKD specification says:

        The mail provider MUST make sure to publish a key in a way
        that only the mail address belonging to the requested user is
        part of the User ID packets included in the returned key.
        Other User ID packets and their associated binding signatures
        MUST be removed before publication.

        https://datatracker.ietf.org/doc/html/draft-koch-openpgp-webkey-service-10#section-5

    Similarly, Hagrid (the software behind https://keys.openpgp.org)
    only returns User IDs and their self signatures for which the
    email has been confirmed.  Using notations, it is not possible to
    separately confirm the linked identifies, and Hagrid must either
    publish a User ID with all of the linked identities, publish the
    User ID without a self signature, or not publish the User ID at
    all.  All of those options are unsatisfying.

:) Neal

---

From: Wiktor Kwapisiewicz <[email-masked]>
Date: Wed, 30 Sep 2020 15:04:34 +0200

Hi Neal,

Actually Vincent's draft was already discussed on the list in 2017
including the design decision of using User Attributes and I have to
agree with Werner's quote from back then:

> (...)  We have notation data which can be
> used to add meta data to a user id.
> 
> Hiding things which might act as identities in UAT does not feel right.
> We better keep UAT for what they are used today - for the more or less
> useless photo-ids

Source:
https://mailarchive.ietf.org/arch/msg/openpgp/zgGQW8qPtJ94tkEVDpDJNsAdkxE/

Yes, you can't certify notations but why would you want to certify my
Twitter handle? It's not up to you to decide if it's valid. The proof is
designed to be checked against the actual service (Twitter in this case).

> When Alice certifies that "Bob <[email-masked]>" controls the
Certificate  0xBBBB, is she also certifying Bob's linked identities?

No, why would she? And why is this any different from Alice signing
Bob's User ID containing any other notation? Consider the alternative:
if Bob adds notation to his User ID saying "Alice loves me" should Alice
signature over that User ID be treated as her commitment? Clearly not.

As for the OpenKeychain example please note that the stable version
removed support for their linked identities [0].

[0]: https://github.com/open-keychain/open-keychain/pull/2408

It could be argued that it's the tooling that was missing but given that
both WKD and verifying keyservers strip User Attributes left and right
adding support for your design would require massive implementation
effort on all sides for a questionable benefit.

Thanks for your feedback!

Kind regards,
Wiktor

---

From: "Neal H. Walfield" <[email-masked]>
Date: Wed, 30 Sep 2020 15:23:17 +0200

On Wed, 30 Sep 2020 15:04:34 +0200,
> https://mailarchive.ietf.org/arch/msg/openpgp/zgGQW8qPtJ94tkEVDpDJNsAdkxE/

Thanks for pointing to that discussion.

Vincent also defends his design there and I find his arguments
convincing.  In particular, we should try and make the parsers
simpler by using UAs to mark items as exactly what they are.

> designed to be checked against the actual service (Twitter in this case).

Would you also argue that it is not up to me to decide if an email is
valid for a given key, but up to the email server?  I wouldn't and I
don't see the fundamental difference.

> signature over that User ID be treated as her commitment? Clearly not.

Clearly(tm).  :D.

> [0]: https://github.com/open-keychain/open-keychain/pull/2408

Thanks for pointing this out.

> effort on all sides for a questionable benefit.

This is a bit unfair.  WKD and verifying keyservers also strip User
IDs left and right, and for good reasons: they only return what they
can authenticate.

FWIW, I think a WKD ought to be allowed to return more, and the WoT
should be used for authenticating bindings, but that is a different
discussion.

As for Hagrid, it could be modified to return UAs that can be
authenticated similar to how it authenticates email addresses (e.g.,
checking proofs or, say, sending a DM on twitter and requiring a
reply).

Sure, modifying software is work.  But I disagree with your claim that
it is a "massive implementation effort".  And, I think the work would
move the ecosystem forward in a positive way.

:) Neal

---

From: Jon Callas <[email-masked]>
Date: Wed, 30 Sep 2020 16:14:22 -0700

I've been reading through a lot of this documentation and I like the idea of whatever we want to call them.

I also think I agree that they'd be better as User Attributes than notations.

Notations are supposed to be an analogue to X.509v3 extensions; they are a way to write arbitrary, free-form data into a signature (and thus a certification). The name is significant. A signer makes a signature, and puts notes into that signature to express or clarify what the signature means.

In contrast, a User Attribute is the generalization of a User ID. It says "this key speaks for <ID>" whether that ID is an email address, etc. and then various keys make certification signatures stating that they agree with that.

So it seems to me that the proper syntax to do this within the structure of OpenPGP would be to have the statement be in a User Attribute, and then concurring keys certify that, possibly with notations.

I can think of another utterly different syntax, though, that would be similar to what Vinnie Moscaritolo and Tony Mione did in "PGP Tickets" which you can find as an I-D at <https://tools.ietf.org/html/draft-moscaritolo-mione-pgpticket-03>. 

The idea here would be that it would be like an Attribute Certificate, or a capability. It would permit (e.g.) a sysadmin to be able to say that the holder of a key is the owner of a file path on a server. (Vinnie wrote software for this exact case. You could sign in to a file server with an OpenPGP key and the ticket could describe what authorizations you had.)

I don't think this is exactly what you want, but it's close. An advantage of the ticket approach is that you don't need anyone's permission to do it. It could literally be a bit of defined YAML or JSON that you clear-sign as text, and then poof, you're done. You don't have to listen to any of us give helpful comments about what you want to do, you just do it.

	Jon