Subject: Re: draft-ietf-openpgp-rfc2440bis-06.txt

From: [email-masked]
Date: Tue, 24 Sep 2002 18:08:17 +0200

Bodo Moeller wrote:
> Of course the one problem we cannot avoid is that the legitimate owner
> of the key cannot keep the key alive indefinitely.  This is because
> this "problem" is exactly the security feature that me and Florian
> Weimer and Derek Atkins want to have: we don't want the bad guy to be
> able to unexpire the key if he gets hold of the secret key.

so set key expiration in direct key signature. there can be only
one direct key signature. direct key signature is self signature (5.2.3.3)
so key expiration can be set in it. (though most PGP implementations may
not recognize key expiration in direct key signature....)

5.2.3.6. Key expiration time
   (4 octet time field)
   The validity period of the key.  This is the number of seconds after
   the key creation time that the key expires.  If this is not present
   or has a value of zero, the key never expires. This is found only on
                                                          ^^^^^^^^^^^^^
   a self-signature.
   ^^^^^^^^^^^^^^^^   

5.2.3.3. Notes on Self-Signatures
   A self-signature is a binding signature made by the key the
   signature refers to. There are three types of self-signatures, the
   certification signatures (types 0x10-0x13), the direct-key signature
                                               ^^^^^^^^^^^^^^^^^^^^^^^^
   (type 0x1f), and the subkey binding signature (type 0x18).

__
Disastry  http://disastry.dhs.org/
http://disastry.dhs.org/pgp
 ^----PGP 2.6.3ia-multi06 (supports IDEA, CAST5, BLOWFISH, TWOFISH,
      AES, 3DES ciphers and MD5, SHA1, RIPEMD160, SHA2 hashes)

---

From: David Shaw <[email-masked]>
Date: Tue, 24 Sep 2002 13:05:32 -0400

On Tue, Sep 24, 2002 at 06:08:17PM +0200, [email-masked] wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
> 
> Bodo Moeller wrote:

It is not true that there can be only one direct key signature.  In
fact, in certain cases you pretty much must have more than one.  For
example, if you have multiple designated revokers which are all
sensitive.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson