Subject: Re: Behavior of implementations regarding certain key material

From: [email-masked]
Date: Tue, 30 May 2000 15:58:57 -0700

Paul Koning writes, quoting Len Sassaman:
>  L> Eh? If you sign my key, and then your *key* expires, your
>  L> signature is still included in validity calculations for my
>  L> key. Even after your key expires. (However, you had to sign my key
>  L> prior to the expiration of yours).
>
> Agreed; that's what I meant.  (Checking the signature requires a key
> that was good at the time that signature was created.  It's the
> signature that is being verified, and the date of that signature is
> what matters.)

The problem is that we don't have a mechanism for securely timestamping
signatures.  If someone breaks or steals an expired key, they can create
a back-dated signature with it.

In my opinion it is risky to rely on a signature by an expired key.
PGP versions 5.0 and later do not use expired keys in trust calculations.
(PGP 2.6.2 and earlier did not support key expiration.)

Hal

---

From: [email-masked] (Lutz Donnerhacke)
Date: 31 May 2000 08:44:35 GMT

* [email-masked] wrote:
>signatures.

There are techniques to do so (eternity log, ...) but they are
contraproductive on signature generation. Timestamps are optionally on
reception. In most cases they are generated implicit by starting an
business action.

>If someone breaks or steals an expired key, they can create a back-dated
>signature with it.

German politics generated a (not required) appendix to the law, prohibitting
specifically to back-date a computer while signing a document. So I can not
happen. :-)

>In my opinion it is risky to rely on a signature by an expired key.

No.

>PGP versions 5.0 and later do not use expired keys in trust calculations.

Bad choice.

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 31 May 2000 15:42:22 +0200

>>> Eh? If you sign my key, and then your *key* expires, your
>>> signature is still included in validity calculations for my
>>> key. Even after your key expires. (However, you had to sign my key
>>> prior to the expiration of yours).

> In my opinion it is risky to rely on a signature by an expired key.

Possibly, but ignoring keys on the grounds that they are expired does
not buy you much because of the expiry date protocol failure in the
OpenPGP key format.  I've brought this up some time ago on this
mailing list, here's a reminder:

In the old PGP key format, key certification covers the expiration
time, and all is well. (The validity period [key creation time and key
expiration time] is part of the version 3 public key packet.)
However, in the current OpenPGP key format, the key expiration time is
covered only by self-signatures.  (A version 4 public key packet
cannot specify a validity period.  The key validity period is in the
signature packet instead.)  Thus, if someone breaks or steals an
expired OpenPGP key, they can renew it, and the old certificates will
remain valid for the key with extended validity period or unlimited
validity.

Fix: Always include a signature expiration time when certifying a key
that has a key expiration date in its self-signature; the time must be
chosen such that the certificate's validity does not extend further
into the future than the key's validity.

The bottom line is that if you don't want to rely on signatures by
expired keys, then you cannot rely on any certificates that don't
contain a signature expiration time (unless the certified key
is in a version 3 public key packet).

-- 
Bodo Möller <[email-masked]>
PGP http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller/0x36d2c658.html
* TU Darmstadt, Theoretische Informatik, Alexanderstr. 10, D-64283 Darmstadt
* Tel. +49-6151-16-6628, Fax +49-6151-16-6036