diff --git a/book/source/04-certificates.md b/book/source/04-certificates.md index 1af95c3..2303d2b 100644 --- a/book/source/04-certificates.md +++ b/book/source/04-certificates.md @@ -172,6 +172,7 @@ Each {term}`User ID` carries associated preference settings, such as preferred e The {term}`primary User ID` was historically the main store for preferences that apply to the {term}`certificate` as a whole. For more on this, see {ref}`primary-metadata`. +(user_attributes)= ### User attributes in OpenPGP While [user attributes](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-user-attribute-packet-tag-1) are similar to {term}`User IDs`, they are less commonly used. @@ -283,7 +284,7 @@ For more detailed information on {term}`revoking` specific {term}`co Since its inception, {term}`third-party identity certifications` have been a cornerstone of the OpenPGP ecosystem. The original PGP designers, starting with Phil Zimmermann, advocated for decentralized {term}`trust models` over reliance on centralized authorities. This decentralized approach in OpenPGP is known as the ["Web of Trust."](wot) -Third-party {term}`certifications` are statements by OpenPGP users confirming that a user with a specific {term}`identity` is the owner of a particular {term}`OpenPGP certificate`. +{term}`Third-party certifications` are statements by OpenPGP users confirming that a user with a specific {term}`identity` is the owner of a particular {term}`OpenPGP certificate`. For example, Bob's OpenPGP software may issue a {term}`certification` that Bob has checked that the {term}`User ID` `Alice Adams ` and the {term}`certificate` with the {term}`fingerprint` `AAA1 8CBB 2546 85C5 8358 3205 63FD 37B6 7F33 00F9 FB0E C457 378C D29F 1026 98B3` are legitimately linked. diff --git a/book/source/06-signatures.md b/book/source/06-signatures.md index 7dc8b2f..83c9872 100644 --- a/book/source/06-signatures.md +++ b/book/source/06-signatures.md @@ -32,7 +32,7 @@ The OpenPGP standard defines a set of [Signature types](https://www.ietf.org/arc {term}`Signature types` can be predominantly classified in two ways: -- **{term}`Signatures over data`**: These signatures are denoted by {term}`type IDs` `0x00` for binary documents and `0x01` for canonical text documents. The {term}`signer` uses these {term}`signatures` to claim ownership, assert creation, or certify the immutability of the document. +- **{term}`Signatures over data`**: These signatures are denoted by {term}`type IDs` `0x00` for binary documents and `0x01` for canonical text documents. The {term}`signer` uses these {term}`signatures` to claim ownership, assert creation, or certify the immutability of the document. - **{term}`Signatures on components`**: These are {term}`signatures` that are associated with {term}`component keys` or {term}`identity components` of a {term}`certificate`. {term}`Signatures on components` are a complex topic, and we discuss them in depth in {ref}`component_signatures_chapter`. They are grouped based on two criteria: @@ -140,7 +140,7 @@ In the OpenPGP protocol, each {term}`signature subpacket` that may support only certain subsets of the standard. Moreover, it anticipates the evolution of the standard, including the addition of new {term}`subpacket types`. -Consider a scenario where an {term}`implementation` does not recognize a {term}`subpacket` indicating {term}`signature` {term}`expiration`. Without understanding this concept, the {term}`implementation` might erroneously accept an already {term}`expired` {term}`signature`. By marking the {term}`expiration date subpacket` as {term}`critical`, the creator of the {term}`signature` ensures that any recipient who cannot process this {term}`subpacket` will reject the {term}`signature` as {term}`invalid`. +Consider a scenario where an {term}`implementation` does not recognize a {term}`subpacket` indicating {term}`signature` {term}`expiration`. Without understanding this concept, the {term}`implementation` might erroneously accept an already {term}`expired` {term}`signature`. By marking the {term}`signature expiration time subpacket` as {term}`critical`, the creator of the {term}`signature` ensures that any recipient who cannot process this {term}`subpacket` will reject the {term}`signature` as {term}`invalid`. For specific guidelines on which {term}`subpackets` should be marked as {term}`critical`, refer to the {term}`RFC` sections [5.2.3.11](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-creation-time) to [5.2.3.36](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-intended-recipient-fingerpr). diff --git a/book/source/07-signing_data.md b/book/source/07-signing_data.md index 2dd56b4..a9d7c6b 100644 --- a/book/source/07-signing_data.md +++ b/book/source/07-signing_data.md @@ -6,67 +6,68 @@ SPDX-License-Identifier: CC-BY-SA-4.0 (signing_data)= # Signatures over data -In OpenPGP, a *data signature* guarantees the authenticity and, implicitly, the integrity of certain data. Typical use cases of data signatures include the authentication of software packages and emails. +In OpenPGP, a *{term}`data signature`* guarantees the {term}`authenticity` and, implicitly, the integrity of certain data. Typical use cases of {term}`data signatures` include the {term}`authentication` of software packages and emails. -"Authenticity" in this context means that the data signature was issued by the entity controlling the signing key material. However, -it does not automatically signal if the expected party indeed controls the signer certificate. OpenPGP does offer mechanisms for *strong authentication*, connecting certificates to specific identities. This verifies that the intended communication partner is indeed associated with the cryptographic identity behind the signature[^sign-auth]. +"{term}`Authenticity`" in this context means that the {term}`data signature` was issued by {term}`the entity controlling the signing key material`. However, +it does not automatically signal if the expected party indeed controls the {term}`signer` {term}`certificate`. OpenPGP does offer mechanisms for *strong {term}`authentication`*, connecting {term}`certificates` to specific {term}`identities`. This verifies that the intended communication partner is indeed associated with the cryptographic {term}`identity` behind the {term}`signature`[^sign-auth]. -[^sign-auth]: Other signing solutions, like [signify](https://flak.tedunangst.com/post/signify), focus on pure signing without strong authentication of the signer's identity. +[^sign-auth]: Other signing solutions, like [signify](https://flak.tedunangst.com/post/signify), focus on pure signing without strong {term}`authentication` of the {term}`signer`'s {term}`identity`. -Data signatures can only be issued by component keys with the *signing* [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags). +{term}`Data signatures` can only be issued by {term}`component keys` with the *{term}`signing`* [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags). -Note that data signatures are distinct from {ref}`component_signatures_chapter`, which are used to form and maintain certificates, as well as to certify identities on certificates. +Note that {term}`data signatures` are distinct from {ref}`component_signatures_chapter`, which are used to form and maintain {term}`certificates`, as well as to {term}`certify` {term}`identities` on {term}`certificates`. (data_signature_types)= ## Signature types -OpenPGP data signatures use one of two [signature types](signature_types): +{term}`OpenPGP data signatures` use one of two [signature types](signature_types): -- [**Binary signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#sigtype-binary) (type ID `0x00`): This is the standard signature type for binary data and is typically used for files or data streams. Binary signatures are calculated over the data without any modifications or transformations. -- [**Text signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-of-a-canonical-te) (type ID `0x01`): Used for textual data, such as email bodies. When calculating a text signature, the data is first normalized by converting line endings into a canonical form (``). This approach mitigates issues caused by platform-specific text encodings. This is especially important for detached and cleartext signatures, where the message file might undergo re-encoding between the creation and verification of the signature. +- [**Binary signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#sigtype-binary) ({term}`type ID` `0x00`): This is the standard {term}`signature type` for binary data and is typically used for files or data streams. {term}`Binary signatures` are calculated over the data without any modifications or transformations. +- [**Text signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-of-a-canonical-te) ({term}`type ID` `0x01`): Used for textual data, such as email bodies. When calculating a {term}`text signature`, the data is first normalized by converting line endings into a canonical form (``). This approach mitigates issues caused by platform-specific text encodings. This is especially important for detached and {term}`cleartext signatures`, where the message file might undergo re-encoding between the creation and {term}`verification` of the {term}`signature`. -Data signatures are generated by hashing the message content along with the metadata in the OpenPGP signature packet, and calculating a cryptographic signature over that hash. The resulting cryptographic signature is stored in the signature packet. +{term}`Data signatures` are generated by {term}`hashing` the message content along with the {term}`metadata` in the {term}`OpenPGP signature packet`, and calculating a {term}`cryptographic signature` over that {term}`hash`. The resulting {term}`cryptographic signature` is stored in the {term}`signature packet`. -Data signature packets manifest in three distinct forms, which will be detailed in the subsequent section. +{term}`Data signature packets` manifest in three distinct forms, which will be detailed in the subsequent section. +(forms_of_openpgp_data_signatures)= ## Forms of OpenPGP data signatures -OpenPGP data signatures can be applied in three distinct forms[^sign-modes-gpg]: +{term}`OpenPGP data signatures` can be applied in three distinct forms[^sign-modes-gpg]: -- **Detached**: The OpenPGP signature exists as a separate entity, independent of the signed data. -- **Inline**: Both the original data and its corresponding OpenPGP signature are encapsulated within an OpenPGP container. -- **Cleartext signature**: A plaintext message and its OpenPGP signature coexist in a combined text format, preserving the readability of the original message. +- **{term}`Detached`**: The OpenPGP signature exists as a separate entity, independent of the signed data. +- **{term}`Inline`**: Both the original data and its corresponding {term}`OpenPGP signature` are encapsulated within an {term}`OpenPGP message`. +- **{term}`Cleartext signature`**: A plaintext message and its {term}`OpenPGP signature` coexist in a combined text format, preserving the readability of the original message. -[^sign-modes-gpg]: These three forms of signature application align with GnuPG's `--detach-sign`, `--sign`, and `--clearsign` command options. +[^sign-modes-gpg]: These three forms of {term}`signature` application align with GnuPG's `--detach-sign`, `--sign`, and `--clearsign` command options. ### Detached signatures -A detached signature is produced by calculating an OpenPGP signature over the data intended for signing. The original data remains unchanged, and the OpenPGP signature is stored as a standalone file. A detached signature file can be distributed alongside or independent of the original data. The authenticity and integrity of the original data file can be verified by using the detached signature file. +A {term}`detached signature` is produced by calculating an {term}`OpenPGP signature` over the data intended for signing. The original data remains unchanged, and the {term}`OpenPGP signature` is stored as a standalone file. A {term}`detached signature` file can be distributed alongside or independent of the original data. The {term}`authenticity` and integrity of the original data file can be {term}`verified` by using the {term}`detached signature` file. -This signature format is especially useful for signing software releases and other files where it is imperative that the content remains unaltered during the signing process. +This {term}`signature` format is especially useful for signing software releases and other files where it is imperative that the content remains unaltered during the signing process. (inline_signature)= ### Inline signatures -An inline signature joins the signed data and its corresponding data signature into a single OpenPGP message. +An {term}`inline signature` joins the signed data and its corresponding {term}`data signature` into a single {term}`OpenPGP message`. -This method is commonly used for signing or encrypting emails. Most email software capable of handling OpenPGP communications typically uses inline signatures. +This method is commonly used for signing or encrypting emails. Most email software capable of handling OpenPGP communications typically uses {term}`inline signatures`. #### Structure -An inline-signed OpenPGP message consists of three segments: +An {term}`inline-signed` {term}`OpenPGP message` consists of three segments: -1. [**One-pass signature packets**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#one-pass-sig): These one or more packets precede the signed data and enable signature computation in one pass. +1. [**One-pass signature packets**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#one-pass-sig): These one or more {term}`packets` precede the signed data and enable {term}`signature` computation in one pass. 2. [**Literal data packet**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#lit): This contains the original data (e.g., the body of a message), without additional interpretation or conversion. -3. **Data signature packets**: These contain the cryptographic signature corresponding to the original data. +3. **{term}`Data signature packets`**: These contain the {term}`cryptographic signature` corresponding to the original data. #### Creation -To produce an inline signature, the signer processes the entirety of the data by reading from an input file and writing into an output OpenPGP message file. As the data is processed, the signer simultaneously calculates a cryptographic signature. This procedure results in the appending of a data signature packet to the output OpenPGP message file, where it can be efficiently stored. +To produce an {term}`inline signature`, the {term}`signer` processes the entirety of the data by reading from an input file and writing into an output {term}`OpenPGP message` file. As the data is processed, the {term}`signer` simultaneously calculates a {term}`cryptographic signature`. This procedure results in the appending of a {term}`data signature packet` to the output {term}`OpenPGP message` file, where it can be efficiently stored. -For efficient verification, an application must understand how to handle the literal data prior to its reading. This requirement is addressed by the one-pass signature packets located at the beginning of inline-signed messages. These packets include essential information such as the fingerprint of the signing key and the hash algorithm used for computing the signature's hash digest. This setup enables the verifier to process the data correctly and efficiently. +For efficient {term}`verification`, an application must understand how to handle the {term}`literal data` prior to its reading. This requirement is addressed by the {term}`one-pass signature packets` located at the beginning of {term}`inline-signed` messages. These {term}`packets` include essential information such as the {term}`fingerprint` of the {term}`signing key` and the {term}`hash` algorithm used for computing the {term}`signature`'s {term}`hash digest`. This setup enables the verifier to process the data correctly and efficiently. ```{admonition} TODO :class: warning @@ -78,23 +79,23 @@ Realization: It's probably useful to know the fingerprints right away, to first #### Verification -Inline-signed messages enable efficient verification in *one pass*, structured as follows: +{term}`Inline-signed` messages enable efficient {term}`verification` in *one pass*, structured as follows: -1. **Initiation with one-pass signature packets**: These packets begin the verification process. They include the signer's key ID/fingerprint, essential for identifying the appropriate public key for signature validation. +1. **Initiation with {term}`one-pass signature packets`**: These {term}`packets` begin the {term}`verification` process. They include the {term}`signer`'s {term}`key ID`/{term}`fingerprint`, essential for identifying the appropriate {term}`public key` for signature {term}`validation`. -2. **Processing the literal data packet**: This step involves hashing the literal data, preparing it for signature verification. +2. **Processing the {term}`literal data packet`**: This step involves {term}`hashing` the literal data, preparing it for {term}`signature` {term}`verification`. -3. **Verifying signature packets**: Located at the end of the message, these packets are checked against the previously calculated hash digest. +3. **{term}`Verifying` {term}`signature packets`**: Located at the end of the message, these {term}`packets` are checked against the previously calculated {term}`hash digest`. -Important to note, the signer's public key, critical for the final verification step, is not embedded in the message. Verifiers must acquire this key externally (e.g., from a key server) to authenticate the signature successfully. +Important to note, the {term}`signer`'s {term}`public key`, critical for the final {term}`verification` step, is not embedded in the message. Verifiers must acquire this {term}`key` externally (e.g., from a {term}`key server`) to authenticate the {term}`signature` successfully. (cleartext-sig)= ### Cleartext signatures -The *Cleartext Signature Framework* (CSF) in OpenPGP accomplishes two primary objectives: +The *{term}`Cleartext Signature Framework`* (CSF) in OpenPGP accomplishes two primary objectives: - maintaining the message in a human-readable cleartext format, accessible without OpenPGP-specific software -- incorporating an OpenPGP signature for authentication by users with OpenPGP-compatible software +- incorporating an {term}`OpenPGP signature` for {term}`authentication` by users with OpenPGP-compatible software #### Example @@ -115,31 +116,31 @@ r13/eqMN8kfCDw== -----END PGP SIGNATURE----- ``` -This signature consists of two parts: a message ("hello world") and an ASCII-armored OpenPGP signature. The message is immediately comprehensible to a human reader, while the signature block allows for the message's authenticity verification via OpenPGP software. +This {term}`signature` consists of two parts: a message ("hello world") and an ASCII-armored {term}`OpenPGP signature`. The message is immediately comprehensible to a human reader, while the {term}`signature` block allows for the message's {term}`authenticity` {term}`verification` via OpenPGP software. #### Use case -Clear text signatures combine the advantages of both detached and inline signatures: +{term}`Cleartext signatures` combine the advantages of both {term}`detached` and {term}`inline signatures`: -- **Self-contained format**: Cleartext signatures enable the message and its signature to be stored as a single file. +- **Self-contained format**: {term}`Cleartext signatures` enable the message and its {term}`signature` to be stored as a single file. -- **Human readability**: The message within a cleartext signature remains accessible in a plain text format. This eliminates the need for specialized software to read the message content. +- **Human readability**: The message within a {term}`cleartext signature` remains accessible in a plain text format. This eliminates the need for specialized software to read the message content. These features are particularly beneficial in scenarios where signed messages are managed semi-manually and where existing system infrastructure offers limited or no native support for OpenPGP in the workflow[^arch-certifications]. -[^arch-certifications]: An illustrative example is the workflow adopted by Arch Linux to certify User IDs of new packagers. This process relies on [cleartext signed statements from existing packagers](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/blob/master/.gitlab/issue_templates/New%20Packager%20Key.md?ref_type=heads&plain=1#L33-46). These signed statements are stored as attachments in an issue tracking system for later inspection. The advantage of this approach lies in the convenience of having the message and signature in a single file, which simplifies manual handling. Based on the vouches in these cleartext signed messages and an [email confirmation from the new packager](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/verify-a-packager-key), the main key operators can issue OpenPGP third-party certifications. +[^arch-certifications]: An illustrative example is the workflow adopted by Arch Linux to {term}`certify` {term}`User IDs` of new packagers. This process relies on [cleartext signed statements from existing packagers](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/blob/master/.gitlab/issue_templates/New%20Packager%20Key.md?ref_type=heads&plain=1#L33-46). These signed statements are stored as attachments in an issue tracking system for later inspection. The advantage of this approach lies in the convenience of having the message and signature in a single file, which simplifies manual handling. Based on the vouches in these {term}`cleartext signed` messages and an [email confirmation from the new packager](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/workflows/verify-a-packager-key), the main key operators can issue {term}`OpenPGP third-party certifications`. #### Text transformations for cleartext signatures -The cleartext signature framework includes specific text normalization procedures to ensure the integrity and clarity of the message: +The {term}`cleartext signature framework` includes specific text normalization procedures to ensure the integrity and clarity of the message: -- **Escaping dashes**: The framework implements a method of [dash-escaped text](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-dash-escaped-text) within the message. Dash-escaping ensures that the parser correctly distinguishes between the armor headers, which are part of the signature's structure, and any lines in the message that happen to start with a dash. +- **Escaping dashes**: The framework implements a method of [dash-escaped text](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-dash-escaped-text) within the message. Dash-escaping ensures that the parser correctly distinguishes between the armor headers, which are part of the {term}`signature`'s structure, and any lines in the message that happen to start with a dash. -- **Normalization of line endings**: Consistent with the approach for any other [text signature](data_signature_types), a cleartext signature is calculated on the text with normalized line endings (``). This ensures that the signature remains valid regardless of the text format of the receiving implementation. +- **Normalization of line endings**: Consistent with the approach for any other [text signature](data_signature_types), a {term}`cleartext signature` is calculated on the text with normalized line endings (``). This ensures that the {term}`signature` remains valid regardless of the text format of the receiving {term}`implementation`. #### Pitfalls -Despite their widespread adoption, cleartext signatures have their limitations and are sometimes viewed as a "legacy method"[^csf-gnupg]. The RFC details the [pitfalls of cleartext signatures](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-issues-with-the-cleartext-s), such as incompatibility with semantically meaningful whitespace, challenges with large messages, and security vulnerabilities related to misleading Hash header manipulations. Given these issues, safer alternatives like inline and detached signature forms are advised. +Despite their widespread adoption, {term}`cleartext signatures` have their limitations and are sometimes viewed as a "legacy method"[^csf-gnupg]. The {term}`RFC` details the [pitfalls of cleartext signatures](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-issues-with-the-cleartext-s), such as incompatibility with semantically meaningful whitespace, challenges with large messages, and security vulnerabilities related to misleading Hash header manipulations. Given these issues, safer alternatives like {term}`inline` and {term}`detached signature` forms are advised. [^csf-gnupg]: https://lists.gnupg.org/pipermail/gnupg-devel/2023-November/035428.html @@ -151,4 +152,4 @@ Despite their widespread adoption, cleartext signatures have their limitations a :class: warning Write -``` \ No newline at end of file +``` diff --git a/book/source/08-signing_components.md b/book/source/08-signing_components.md index 6c8f3cc..17abd1d 100644 --- a/book/source/08-signing_components.md +++ b/book/source/08-signing_components.md @@ -6,198 +6,200 @@ SPDX-License-Identifier: CC-BY-SA-4.0 (component_signatures_chapter)= # Signatures on components -This chapter examines OpenPGP signatures associated with certificate components, applying to: +This chapter examines {term}`OpenPGP signatures` associated with {term}`certificate components`, applying to: -- component keys, encompassing primary keys and subkeys -- identity components, namely User IDs and User attributes +- {term}`component keys`, encompassing {term}`primary keys` and {term}`subkeys` +- {term}`identity components`, namely {term}`User IDs` and {term}`User attributes` -Signatures on components are used to construct and maintain certificates, and to model the authentication of identities. +{term}`Signatures on components` are used to construct and maintain {term}`certificates`, and to model the {term}`authentication` of {term}`identities`. This chapter expands on topics introduced in the {ref}`certificates_chapter` chapter. ## Self-signatures vs third-party signatures -Component signatures in OpenPGP are categorized into two distinct types: +{term}`Component signatures` in OpenPGP are categorized into two distinct types: -- **self-signatures**, which are issued by the certificate holder using the certificate's primary key -- **third-party signatures**, which are issued by an external entity, not the certificate holder +- **{term}`self-signatures`**, which are issued by the {term}`certificate holder` using the {term}`certificate`'s {term}`primary key` +- **{term}`third-party signatures`**, which are issued by an external entity, not the {term}`certificate holder` +(self-signatures)= ### Self-signatures -Self-signatures are fundamental in creating and managing OpenPGP certificates. They bind the various components of a certificate into one combined data structure and facilitate the certificate's life-cycle management. +{term}`Self-signatures` are fundamental in creating and managing {term}`OpenPGP certificates`. They bind the various {term}`components` of a {term}`certificate` into one combined data structure and facilitate the {term}`certificate`'s {term}`life-cycle management`. -Life-cycle management operations include: +{term}`Life-cycle management` operations include: -- binding additional components to a certificate -- modifying expiration dates or other metadata of components -- revoking, and thus invalidating, components or existing self-signatures +- {term}`binding` additional {term}`components` to a {term}`certificate` +- modifying {term}`expiration time` or other {term}`metadata` of `components` +- revoking, and thus invalidating, {term}`components` or existing {term}`self-signatures` -Self-signatures are issued by the certificate's owner using the certificate's primary key. +{term}`Self-signatures` are issued by the {term}`certificate's owner` using the {term}`certificate`'s {term}`primary key`. ```{note} -No [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags) is required to issue self-signatures. An OpenPGP primary key can issue self-signatures by default. +No [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags) is required to issue {term}`self-signatures`. An {term}`OpenPGP primary key` can issue {term}`self-signatures` by default. ``` ### Third-party signatures -Third-party signatures are pivotal in OpenPGP for decentralized authentication, forming the basis of the Web of Trust. They encode authentication-related statements about certificates and linked identities, establishing trustworthiness of identity claims. +{term}`Third-party signatures` are pivotal in OpenPGP for decentralized {term}`authentication`, forming the basis of the {term}`Web of Trust`. They encode {term}`authentication`-related statements about {term}`certificates` and linked {term}`identities`, establishing trustworthiness of {term}`identity claims`. Third-party signatures are used to make specific statements: -- certifying identity claims -- delegating authentication decisions -- revoking, and thus invalidating, prior third-party signature statements +- {term}`certifying` {term}`identity claims` +- {term}`delegating` {term}`authentication` decisions +- {term}`revoking`, and thus {term}`invalidating`, prior {term}`third-party signature` statements ```{note} -The **certify others** [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags) (`0x01`) is required to issue third-party signatures. By convention[^primary-certification], only the certificate's primary key can hold this key flag. +The **{term}`certify others`** [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags) (`0x01`) is required to issue {term}`third-party signatures`. By convention[^primary-certification], only the {term}`certificate`'s {term}`primary key` can hold this {term}`key flag`. ``` -[^primary-certification]: Most current implementations assume that only the primary key may hold the *certify others* key flag, although this is not specified in the RFC. +[^primary-certification]: Most current {term}`implementations` assume that only the {term}`primary key` may hold the *{term}`certify others`* {term}`key flag`, although this is not specified in the {term}`RFC`. ### Distinct functions of self-signatures and third-party signatures -The meaning of an OpenPGP signature depends significantly on its issuer. Self-signatures and third-party signatures, even when of the same [signature type](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-types), serve distinct functions. For example: +The meaning of an {term}`OpenPGP signature` depends significantly on its {term}`issuer`. {term}`Self-signatures` and {term}`third-party signatures`, even when of the same [signature type](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-types), serve distinct functions. For example: -- Certifying self-signatures (type IDs `0x10` - `0x13`) bind a User ID to a certificate. -- Third-party signatures of the same type IDs endorse the authenticity of a User ID on another user's certificate. +- {term}`Certifying self-signatures` ({term}`type IDs` `0x10` - `0x13`) bind a {term}`User ID` to a {term}`certificate`. +- {term}`Third-party signatures` of the same {term}`type IDs` endorse the {term}`authenticity` of a {term}`User ID` on another user's {term}`certificate`. In another instance: -- *When issued as a self-signature*, a [direct key signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) sets preferences and advertises features applicable to the entire certificate. -- *When issued by a third party*, especially when it carries a [trust signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-trust-signature) subpacket, a similar direct key signature delegates trust to the signed certificate. This may designate the signed certificate as a trust root within the issuer's Web of Trust. +- *When issued as a {term}`self-signature`*, a [direct key signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) sets {term}`preferences` and advertises {term}`features` applicable to the entire {term}`certificate`. +- *When issued by a {term}`third party`*, especially when it carries a [trust signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-trust-signature) {term}`subpacket`, a similar {term}`direct key signature` {term}`delegates` trust to the signed {term}`certificate`. This may designate the signed {term}`certificate` as a {term}`trust anchor` within the {term}`issuer`'s {term}`Web of Trust`. (binding_sigs)= ## Self-signatures in certificate formation and management -Self-signatures play a crucial role in forming and managing the structure of OpenPGP certificates. These act as *binding signatures*, joining components and embedding metadata. +{term}`Self-signatures` play a crucial role in forming and managing the structure of {term}`OpenPGP certificates`. These act as *{term}`binding signatures`*, joining {term}`components` and embedding {term}`metadata`. -Internally, an OpenPGP certificate is essentially a series of packets strung sequentially. When a certificate is stored in a file format known as a [transferable public key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-transferable-public-keys), packets can be easily added or removed. +Internally, an {term}`OpenPGP certificate` is essentially a series of {term}`packets` strung sequentially. When a {term}`certificate` is stored in a file format known as a [transferable public key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-transferable-public-keys), {term}`packets` can be easily added or removed. -To safeguard against unauthorized additions or alterations of components, OpenPGP uses cryptographic signatures. These validate that all components, such as subkeys or [identity components](identity_components), were linked to the OpenPGP certificate by its owner, using the primary key. While anyone can still store unrelated elements to a certificate dataset, OpenPGP implementations will reject them if they lack a valid cryptographic connection with the certificate. +To safeguard against unauthorized additions or alterations of {term}`components`, OpenPGP uses {term}`cryptographic signatures`. These validate that all {term}`components`, such as {term}`subkeys` or [identity components](identity_components), were linked to the {term}`OpenPGP certificate` by its {term}`owner`, using the {term}`primary key`. While anyone can still store unrelated elements to a {term}`certificate` dataset, {term}`OpenPGP implementations` will reject them if they lack a {term}`valid` cryptographic connection with the {term}`certificate`. ```{note} -Conversely, omissions of packets by third parties can easily occur when handling an OpenPGP certificate dataset. This could pose a challenge, for example, when an attacker deliberately omits revocation packets. Without access to an alternative, complete certificate source, recipients might not detect these omissions. +Conversely, omissions of {term}`packets` by third parties can easily occur when handling an {term}`OpenPGP certificate` dataset. This could pose a challenge, for example, when an attacker deliberately omits {term}`revocation` {term}`packets`. Without access to an alternative, complete {term}`certificate` source, recipients might not detect these omissions. ``` -However, there are legitimate instances in which third parties add "unbound" packets (i.e., not signed by the certificate's owner) to a certificate: +However, there are legitimate instances in which third parties add "unbound" {term}`packets` (i.e., not signed by the {term}`certificate`'s {term}`owner`) to a {term}`certificate`: -- [Third-party certifications](third_party_cert) are often stored within the packet data of the certificate to which they are related. This is a standard practice that provides convenience for users by allowing easy access to all relevant certifications. (See {ref}`cert-flooding` for discussion of a related pitfall.) -- OpenPGP software may locally add [unbound identity data](unbound_user_ids) to a certificate. +- [Third-party certifications](third_party_cert) are often stored within the {term}`packet` data of the {term}`certificate` to which they are related. This is a standard practice that provides convenience for users by allowing easy access to all relevant {term}`certifications`. (See {ref}`cert-flooding` for discussion of a related pitfall.) +- {term}`OpenPGP software` may locally add [unbound identity data](unbound_user_ids) to a {term}`certificate`. (bind_subkey)= ### Binding subkeys to a certificate -Subkeys are linked to OpenPGP certificates via a [subkey binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-subkey-binding) (type ID `0x18`). This signature type indicates the association of the primary key with the subkey. +{term}`Subkeys` are linked to {term}`OpenPGP certificates` via a [subkey binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-subkey-binding) ({term}`type ID` `0x18`). This {term}`signature type` indicates the association of the {term}`primary key` with the {term}`subkey`. -A subkey binding signature binds a subkey to a primary key, and it embeds metadata into the signature packet. Once generated, the subkey binding signature packet is stored in the certificate directly after the subkey it binds. +A {term}`subkey binding signature` binds a {term}`subkey` to a {term}`primary key`, and it embeds {term}`metadata` into the {term}`signature packet`. Once generated, the {term}`subkey binding signature` {term}`packet` is stored in the {term}`certificate` directly after the {term}`subkey` it binds. -Subkeys designated for signing purposes, identified by the *signing* [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags), represent a unique category and are handled differently. See {numref}`bind_subkey_sign`. +{term}`Subkeys` designated for signing purposes, identified by the *{term}`signing`* [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags), represent a unique category and are handled differently. See {numref}`bind_subkey_sign`. ```{figure} diag_converted/subkey_binding_signature.svg :name: fig-subkey-binding-signature :alt: Depicts a diagram on white background with the title "Subkey binding signature". At the top left the symbol of a primary component key with certification capability is shown. At the bottom left the symbol of a component key with encryption capability is shown. The primary component key points at the lower component key with a full green arrow line. In the middle of the connection the small symbol of a signature packet is shown. On the right side of the diagram a detailed version of the signature packet can be found in a box with the title "Subkey binding signature". The text reads "Signature over Primary key, Subkey" and the box with "Signature metadata" contains the list "signature creation time", "key expiration time", "key flags" and "issuer fingerprint". The primary component key points at the detailed signature packet with a dotted green arrow line and the text "Primary key creates a subkey binding signature to bind the subkey to the primary key". -Linking an OpenPGP subkey to the primary key with a binding signature +Linking an {term}`OpenPGP subkey` to the {term}`primary key` with a {term}`binding signature` ``` -Metadata for the subkey, such as the [*key expiration time*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#key-expiration-subpacket) and capabilities set by [*key flags*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#key-flags), are included in subpackets within the subkey binding signature packet. +{term}`Metadata` for the {term}`subkey`, such as the [*key expiration time*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#key-expiration-subpacket) and {term}`capabilities` set by [*key flags*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#key-flags), are included in {term}`subpackets` within the {term}`subkey binding signature` {term}`packet`. ```{note} -The validity of a subkey is intrinsically linked to that of the primary key. An expired primary key renders any associated subkey invalid, regardless of the subkey's own expiration setting. +The {term}`validity` of a {term}`subkey` is intrinsically linked to that of the {term}`primary key`. An {term}`expired` {term}`primary key` renders any associated {term}`subkey` {term}`invalid`, regardless of the {term}`subkey`'s own {term}`expiration` setting. -Legally, a subkey may not have a specified expiry time. In such cases, its expiration aligns implicitly with that of the primary key. Additionally, the creation date of a subkey must always be more recent than that of the primary key. +Legally, a {term}`subkey` may not have a specified {term}`expiration time`. In such cases, its {term}`expiration` aligns implicitly with that of the {term}`primary key`. Additionally, the {term}`creation time` of a {term}`subkey` must always be more recent than that of the {term}`primary key`. ``` (bind_subkey_sign)= ### Special case: Binding signing subkeys -Binding subkeys that possess the *signing* key flag to a certificate represents a unique scenario. While similar to the binding process of other subkeys, there is an additional, critical requirement: mutual association. +{term}`Binding` {term}`subkeys` that possess the *{term}`signing`* {term}`key flag` to a {term}`certificate` represents a unique scenario. While similar to the {term}`binding process` of other {term}`subkeys`, there is an additional, critical requirement: mutual association. -That is, to bind a signing-capable subkey to a primary key, it is insufficient that the "primary key wants to be associated with the subkey." The subkey must explicitly signal that it "wants to be associated with the primary key." +That is, to bind a {term}`signing-capable` {term}`subkey` to a {term}`primary key`, it is insufficient that the "{term}`primary key` wants to be associated with the {term}`subkey`." The {term}`subkey` must explicitly signal that it "wants to be associated with the {term}`primary key`." -This mutual binding is crucial for security. Without it, an individual (e.g., Alice) could falsely claim a connection to another person's (e.g., Bob's) signing subkey. -Alice could thus claim to have issued signatures which were actually issued by Bob. -To prevent such scenarios, where an attacker might wrongfully "adopt" a victim's signing subkey, a dual-layer of signatures is used: +This mutual binding is crucial for security. Without it, an individual (e.g., Alice) could falsely claim a connection to another person's (e.g., Bob's) {term}`signing subkey`. +Alice could thus claim to have issued {term}`signatures` which were actually issued by Bob. +To prevent such scenarios, where an attacker might wrongfully "adopt" a victim's {term}`signing subkey`, a dual-layer of {term}`signatures` is used: -- the [subkey binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-subkey-binding) (type ID `0x18`), which is issued by the certificate's primary key -- the [primary key binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#sigtype-primary-binding) (type ID `0x19`), created by the subkey itself. This is informally known as an embedded "back signature," because the subkey's signature points back to the primary key. +- the [subkey binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-subkey-binding) ({term}`type ID` `0x18`), which is issued by the {term}`certificate`'s {term}`primary key` +- the [primary key binding signature](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#sigtype-primary-binding) ({term}`type ID` `0x19`), created by the {term}`subkey` itself. This is informally known as an embedded "{term}`back signature`," because the {term}`subkey`'s {term}`signature` points back to the {term}`primary key`. ```{figure} diag_converted/subkey_binding_signatur_for_signing_sk.svg :name: fig-subkey-binding-signature-for-signing-subkeys :alt: Depicts a diagram on white background with the title "Subkey binding signature for signing subkeys". At the top left the symbol of a primary component key with certification capability is shown. At the bottom left the symbol of a component key with signing capability is shown. The primary component key points at the lower component key with a full green arrow line. In the middle of the connection the small symbol of a signature packet is shown. On the right side of the diagram a detailed version of the signature packet can be found in a box with the title "Subkey binding signature". The text reads "Signature over Primary key, Subkey" and the box with "Signature metadata" in it contains the list "signature creation time", "key expiration time", "key flags" and "issuer fingerprint". Within the signature metadata a box with a green dotted frame extends the list with an inlined signature packet with the title "Embedded Signature; Primary key binding". Its inner text reads "Signature over Primary Key, Signing Subkey". The signature metadata area of this embedded signature holds the list "signature creation time" and "issuer fingerprint". The cryptographic signature symbol overlaps both metadata and general section of the embedded signature. From the signing component key a green dotted arrow line points to the embedded signature in the subkey binding signature with the text "Signing key creates a primary binding signature to associate itself with the primary key" ("primary binding signature" in bold). At the top of the diagram, the primary component key points at the detailed signature packet with a dotted green arrow line and the text "Primary key creates a subkey binding signature to bind the subkey to the primary key". -Linking an OpenPGP signing subkey to the primary key with a binding signature, and an embedded primary key binding signature +Linking an {term}`OpenPGP signing subkey` to the {term}`primary key` with a {term}`binding signature`, and an embedded {term}`primary key binding signature` ``` -The back signature signifies the mutuality of the subkey's association with the primary key and is embedded as subpacket data within the subkey binding signature, reinforcing the authenticity of the binding. +The {term}`back signature` signifies the mutuality of the {term}`subkey`'s association with the {term}`primary key` and is embedded as {term}`subpacket` data within the {term}`subkey binding signature`, reinforcing the {term}`authenticity` of the {term}`binding`. (bind_ident)= ### Binding identities to a certificate -Self-signatures also play a vital role in binding identity components, such as User IDs or User Attributes, to an OpenPGP certificate. +{term}`Self-signatures` also play a vital role in {term}`binding` {term}`identity components`, such as {term}`User IDs` or {term}`User Attributes`, to an {term}`OpenPGP certificate`. -To bind the User ID `Alice Adams ` to her OpenPGP certificate (`AAA1 8CBB 2546 85C5 8358 3205 63FD 37B6 7F33 00F9 FB0E C457 378C D29F 1026 98B3`), Alice would use a certification signature. +To bind the {term}`User ID` `Alice Adams ` to her {term}`OpenPGP certificate` (`AAA1 8CBB 2546 85C5 8358 3205 63FD 37B6 7F33 00F9 FB0E C457 378C D29F 1026 98B3`), Alice would use a {term}`certification signature`. -There are four types of *certifying self-signature*. The most commonly used type for binding User IDs is the [positive certification](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-positive-cert) (type ID `0x13`). Alternatively, type `0x10`, `0x11`, or `0x12` might be used. This binding signature must be issued by the primary key. +There are four types of *{term}`certifying self-signature`*. The most commonly used {term}`type` for {term}`binding` {term}`User IDs` is the [positive certification](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-positive-cert) ({term}`type ID` `0x13`). Alternatively, {term}`type` `0x10`, `0x11`, or `0x12` might be used. This {term}`binding signature` must be issued by the {term}`primary key`. -The certifying self-signature packet – calculated over the primary key, User ID, and metadata of the signature packet – is added to the certificate, directly following the User ID packet. +The {term}`certifying self-signature` {term}`packet` – calculated over the {term}`primary key`, {term}`User ID`, and {term}`metadata` of the {term}`signature packet` – is added to the {term}`certificate`, directly following the {term}`User ID` {term}`packet`. ```{figure} diag_converted/user_id_certification.svg :name: fig-user-id-certification :alt: Depicts a diagram on white background with the title "User ID binding signature". At the top left the symbol of a primary component key with certification capability is shown. At the bottom left the symbol of a User ID reads "Alice Adams ". The primary component key points at the User ID with a full green arrow line. In the middle of the connection the small symbol of a signature packet is shown. On the right side of the diagram a detailed version of the signature packet can be found in a box with the title "User ID binding signature". The text reads "Signature over Primary key, User ID" and the box with "Signature metadata" in it contains the list "signature creation time", "key expiration time", "primary User ID flag", "algorithm preferences", "key expiration time (primary key)" and "key flags (primary key)". At the top of the diagram, the primary component key points at the detailed signature packet with a dotted green arrow line and the text "Primary key creates a User ID binding signature to associate the User ID with the primary key". -Linking a User ID to an OpenPGP certificate +Linking a {term}`User ID` to an {term}`OpenPGP certificate` ``` (primary-metadata)= ### Adding global metadata to a certificate -The signatures that bind subkeys and identity components to a certificate serve dual purposes: linking components to the certificate and adding metadata to components. +The {term}`signatures` that {term}`bind` {term}`subkeys` and {term}`identity components` to a {term}`certificate` serve dual purposes: linking {term}`components` to the {term}`certificate` and adding {term}`metadata` to {term}`components`. -While it is essential to add metadata that pertains to the entire certificate, this does not require binding any component to the certificate. In this case, the signature mechanism is used just to associate metadata with the certificate globally. +While it is essential to add {term}`metadata` that pertains to the entire {term}`certificate`, this does not require {term}`binding` any {term}`component` to the {term}`certificate`. In this case, the {term}`signature` mechanism is used just to associate {term}`metadata` with the {term}`certificate` globally. -Two signature types can perform this function: +Two {term}`signature types` can perform this function: -- direct key signature on the primary key -- *primary User ID* binding signature +- {term}`direct key signature` on the {term}`primary key` +- {term}`primary User ID binding signature` -The types of metadata typically associated with the certificate through these methods include: +The types of {term}`metadata` typically associated with the {term}`certificate` through these methods include: -- key expiration -- key flags (capabilities) -- features -- algorithm preference signaling +- {term}`key` {term}`expiration` +- {term}`key flags` ({term}`capabilities`) +- {term}`features` +- {term}`algorithm preferences` signaling (direct_key_signature)= #### Direct key signature -A [*direct key signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) serves as the [preferred mechanism](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#section-5.2.3.10-9) in OpenPGP v6 for defining metadata for the entire certificate, by associating it with the primary key. +A [*direct key signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) serves as the [preferred mechanism](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#section-5.2.3.10-9) in OpenPGP v6 for defining {term}`metadata` for the entire {term}`certificate`, by associating it with the {term}`primary key`. +(self_signature_binding_to_primary_user_id)= #### Self-signature binding to primary User ID -In OpenPGP v4, another mechanism was often used for metadata management: integrating global certificate metadata within a User ID binding signature. This is specifically evident in the binding signature of the [*primary* User ID](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-primary-user-id) of the OpenPGP certificate. +In OpenPGP v4, another mechanism was often used for {term}`metadata` management: integrating global {term}`certificate` {term}`metadata` within a {term}`User ID binding signature`. This is specifically evident in the {term}`binding signature` of the [*primary* User ID](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-primary-user-id) of the {term}`OpenPGP certificate`. -This method results in the primary User ID binding signature containing a mix of metadata: some specific to that User ID and some applicable to the certificate globally. +This method results in the {term}`primary User ID binding signature` containing a mix of {term}`metadata`: some specific to that {term}`User ID` and some applicable to the {term}`certificate` globally. -Given the widespread adoption of this mechanism in existing OpenPGP certificates, it is crucial that OpenPGP applications recognize and manage it. +Given the widespread adoption of this mechanism in existing {term}`OpenPGP certificates`, it is crucial that {term}`OpenPGP applications` recognize and manage it. (self-revocations)= ### Revocation self-signatures: Invalidating certificate components -Revocation self-signatures represent an important class of self-signatures, used primarily to invalidate components or retract prior signature statements. +{term}`Revocation self-signatures` represent an important class of {term}`self-signatures`, used primarily to invalidate {term}`components` or retract prior {term}`signature` statements. -There are several types of revocation signatures, each serving a specific purpose: +There are several types of {term}`revocation signatures`, each serving a specific purpose: -- A [**key revocation signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-revocation-signature-ty) (type ID `0x20`) marks a primary key as revoked. -- A [**subkey revocation signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-subkey-revocation-signature) (type ID `0x28`) invalidates the binding of a subkey. -- A [**certification revocation**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) (type ID `0x30`) invalidates the binding of a User ID or User Attribute. +- A [**key revocation signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-revocation-signature-ty) ({term}`type ID` `0x20`) marks a {term}`primary key` as {term}`revoked`. +- A [**subkey revocation signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-subkey-revocation-signature) ({term}`type ID` `0x28`) {term}`invalidates` the {term}`binding of a subkey`. +- A [**certification revocation**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) ({term}`type ID` `0x30`) {term}`invalidates` the {term}`binding` of a {term}`User ID` or {term}`User Attribute`. -Common scenarios for using revocations include marking certificates or individual subkeys as unusable (e.g., when the private key has been compromised or replaced) or declaring User IDs as no longer valid. +Common scenarios for using {term}`revocations` include marking {term}`certificates` or individual {term}`subkeys` as unusable (e.g., when the {term}`private key` has been compromised or replaced) or declaring {term}`User IDs` as no longer {term}`valid`. ```{note} -OpenPGP certificates act as append-only data structures in practice. Once elements of a certificate are published, they cannot be removed from key servers or third-party OpenPGP systems. Implementations usually merge all available components and signatures. +{term}`OpenPGP certificates` act as append-only data structures in practice. Once elements of a {term}`certificate` are published, they cannot be removed from {term}`key servers` or third-party OpenPGP systems. {term}`Implementations` usually merge all available {term}`components` and {term}`signatures`. -Revocations are used to mark components or signatures as invalid. +{term}`Revocations` are used to mark {term}`components` or {term}`signatures` as {term}`invalid`. ``` ```{admonition} TODO @@ -206,151 +208,128 @@ Revocations are used to mark components or signatures as invalid. Research, under what circumstances revocations revoke individual signatures, and when they instead "unbind" components. ``` -Note: certification signatures [can be made irrevocable](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-revocable). +Note: {term}`certification signatures` [can be made irrevocable](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-revocable). +(hard_vs_soft_revocations)= #### Hard vs soft revocations -Revocation signatures often include a [*Reason for Revocation* subpacket](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation), with a code specifying *why* the revocation was issued. This code determines whether the revocation is considered *soft* or *hard*. +{term}`Revocation signatures` often include a [*Reason for Revocation* subpacket](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation), with a code specifying *why* the {term}`revocation` was issued. This code determines whether the {term}`revocation` is considered *soft* or *hard*. -- **Soft revocation**: This is typically used for graceful or planned invalidation of components, such as retiring or updating components. It invalidates the component from the revocation signature's creation time, but earlier uses remain valid. Soft revocations can be reversed with a new self-signature. -- **Hard revocation**: This irrevocably invalidates the component, affecting all past and future uses. It is typically used to signal compromise of secret key material. +- **{term}`Soft revocation`**: This is typically used for graceful or planned {term}`invalidation` of {term}`components`, such as retiring or updating {term}`components`. It {term}`invalidates` the {term}`component` from the {term}`revocation signature`'s {term}`creation time`, but earlier uses remain {term}`valid`. Soft revocations can be reversed with a new {term}`self-signature`. +- **{term}`Hard revocation`**: This irrevocably invalidates the {term}`component`, affecting all past and future uses. It is typically used to signal compromise of {term}`secret key material`. ```{note} -A revocation signature lacking a *Reason for Revocation* subpacket is interpreted as a hard revocation. +A {term}`revocation signature packet` lacking a {term}`Reason for Revocation subpacket` is interpreted as a {term}`hard revocation`. ``` (third_party_cert)= ## Authentication and delegation in third-party signatures -Third-party signatures in OpenPGP primarily encode authentication statements for identities and delegate trust decisions. These signatures can be manually inspected or processed as machine-readable artifacts by OpenPGP software, which evaluates the authenticity of certificates based on user-specified trust roots. +{term}`Third-party signatures` in OpenPGP primarily encode {term}`authentication` statements for {term}`identities` and {term}`delegate` trust decisions. These {term}`signatures` can be manually inspected or processed as machine-readable artifacts by {term}`OpenPGP software`, which evaluates the {term}`authenticity` of {term}`certificates` based on user-specified {term}`trust anchors`. ### Certifying identity components -When a signer issues a certifying signature on an identity, it indicates a verified link between the identity and the certificate. That is, the signer vouches for the identity claim. +When a {term}`signer` issues a {term}`certifying signature` on an {term}`identity`, it indicates a verified link between the {term}`identity` and the {term}`certificate`. That is, the {term}`signer` vouches for the {term}`identity claim`. -For example, Alice can vouch that Bob's User ID `Bob Baker ` is legitimately linked with his certificate `BB28 9FB7 A68D BFA8 C384 CCCD E205 8E02 D9C6 CD2F 3C7C 56AE 7FB5 3D97 1170 BA83`, by creating a certification signature. Bob can then distribute Alice's certifying signature as part of his certificate. +For example, Alice can vouch that Bob's {term}`User ID` `Bob Baker ` is legitimately linked with his {term}`certificate` `BB28 9FB7 A68D BFA8 C384 CCCD E205 8E02 D9C6 CD2F 3C7C 56AE 7FB5 3D97 1170 BA83`, by creating a {term}`certification signature`. Bob can then distribute Alice's `certifying signature` as part of his {term}`certificate`. -Other users may or may not decide to rely on Alice's statement to determine the authenticity of Bob's certificate. +Other users may or may not decide to rely on Alice's statement to determine the {term}`authenticity` of Bob's {term}`certificate`. (delegation)= ### Trust signatures: delegating authentication -OpenPGP uses [*trust signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#trust-signature-subpacket) subpackets to delegate authentication decisions, designating the recipient certificate as a "trusted introducer" (or a trust root) for the user. This includes specifying trust depth (or level) for transitive delegations and quantifying trust with numerical values, indicating the extent of reliance on the introducer's certifications. +OpenPGP uses [*trust signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#trust-signature-subpacket) {term}`subpackets` to {term}`delegate` {term}`authentication` decisions, designating the recipient {term}`certificate` as a "{term}`trusted introducer`" (or a {term}`trust anchor`) for the user. This includes specifying {term}`trust depth` (or level) for transitive {term}`delegations` and quantifying trust with numerical values, indicating the extent of reliance on the {term}`introducer`'s {term}`certifications`. -Trust signature subpackets are applicable in *third-party* signatures, more specifically: +{term}`Trust signature` {term}`subpackets` are applicable in {term}`third-party signatures`, more specifically: -- identity certification signatures (type ID `0x10` - `0x13`) -- [direct key signatures](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) (type ID `0x1F`) +- {term}`identity certification signatures` ({term}`type ID` `0x10` - `0x13`) +- [direct key signatures](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-direct-key-signature-type-i) ({term}`type ID` `0x1F`) +(trust_depth_level)= #### Trust depth/level -The "trust depth" (or level) in OpenPGP signifies the extent of transitive delegation within the authentication process. It determines how far a delegation can be extended from the original trusted introducer to subsequent intermediaries. Essentially, a certificate with a trust depth of more than one acts as a "meta-introducer," facilitating authentication decisions across multiple levels in the network. +The "{term}`trust depth`" (or {term}`level`) in OpenPGP signifies the extent of transitive {term}`delegation` within the {term}`authentication` process. It determines how far a {term}`delegation` can be extended from the original {term}`trusted introducer` to subsequent intermediaries. Essentially, a {term}`certificate` with a {term}`trust depth` of more than one acts as a "{term}`meta-introducer`," facilitating {term}`authentication` decisions across multiple levels in the network. -A trust depth of 1 means relying on certifications made directly by the trusted introducer. The user's OpenPGP software will accept certifications made directly by the introducer for authenticating identities. +A {term}`trust depth` of 1 means relying on {term}`certifications` made directly by the {term}`trusted introducer`. The user's OpenPGP software will accept {term}`certifications` made directly by the {term}`introducer` for {term}`authenticating` identities. -However, when the trust depth is set higher, it implies a chain of delegation may extend beyond the initial introducer. The user's software will recognize and accept certifications made not only by the primary introducer but also by other intermediaries whom the primary introducer designated as trusted introducers. +However, when the {term}`trust depth` is set higher, it implies a chain of {term}`delegation` may extend beyond the {term}`initial introducer`. The user's software will recognize and accept {term}`certifications` made not only by the {term}`primary introducer` but also by other intermediaries whom the {term}`primary introducer` designated as {term}`trusted introducers`. -This allows for a more extensive network of trusted certifications, enabling a broader and more interconnected Web of Trust. - -```{admonition} VISUAL -:class: warning - -Illustrate with diagram(s). Notes for diagrams: - -When Alice delegates trust decisions to Trent, designating Trent as a trusted introducer with a *trust depth* of 1, then Alice's OpenPGP implementation will only accept direct certifications by Trent. For example, Trent may have certified that Bob's certificate with the fingerprint `0xB0B` is legitimately connected to Bob's User ID `Bob `. If Alice tries to communicate with Bob using his identity `Bob `, then Alice's OpenPGP software can automatically determine that the certificate `0xB0B` is appropriate to use. - -However, Alice's OpenPGP software wouldn't accept a series of delegations from Trent via Tristan to a certification of Carol's identity (let's imagine that Trent has designated Tristan a trusted introducer). For Alice's OpenPGP software to accept such a path, she needs to designate Trent as a trusted introducer with the `level` set to 2 or more. -``` +This allows for a more extensive network of trusted {term}`certifications`, enabling a broader and more interconnected {term}`Web of Trust`. +(trust_amounts)= #### Trust amounts -The "trust amount," with a numerical value ranging from 0 to 255, quantifies the degree of reliance on a delegation. +The "{term}`trust amount`," with a numerical value ranging from `0` to `255`, quantifies the degree of reliance on a {term}`delegation`. -A higher value indicates greater degree of reliance. This quantification aids OpenPGP software in determining an aggregate amount of reliance, based on combined certifications from multiple trusted introducers. - -```{admonition} VISUAL -:class: warning - -Illustrate with diagram(s). Notes for diagrams: - -If Alice designates Trent as a trusted introducer at a trust amount of 120, then Alice's OpenPGP software will consider Bob's identity fully authenticated if Trent has certified it. - -However, if Alice only assigns a trust amount of 60 (which indicates "partial trust") to Trent, then her software would not consider Bob's identity fully authenticated. Now let's imagine that Alice additionally assigns a trust amount of 60 to Tristan (a second, independent introducer), and Tristan also certified Bob's identity. In this case, Alice's OpenPGP software will consider Bob's identity fully authenticated, based on the combination of both delegations, and the certifications the two trusted introducers issued. -``` +A higher value indicates greater degree of reliance. This quantification aids {term}`OpenPGP software` in determining an aggregate amount of reliance, based on combined {term}`certifications` from multiple {term}`trusted introducers`. +(limiting_delegation_scope)= #### Limiting delegation scope -When using *trust signature* subpackets, a delegation can be limited to identities that match a [*regular expression*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#regex-subpacket). +When using *{term}`trust signature`* {term}`subpackets`, a {term}`delegation` can be limited to {term}`identities` that match a [*regular expression*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#regex-subpacket). -With this mechanism, for example, it is possible to delegate authentication decisions only for User IDs that match the email domain of an organization. - -```{admonition} VISUAL -:class: warning - -Illustrate with diagram(s). Notes for diagrams: - -For example, Alice could delegate trust decisions only for email addresses in the domain `bob.com` to Bob, if she considers Bob to be a reasonable source of identity certifications for that domain. -``` +With this mechanism, for example, it is possible to {term}`delegate` {term}`authentication` decisions only for {term}`User IDs` that match the email domain of an organization. (wot)= ### Web of Trust: Decentralized trust decisions -The Web of Trust in OpenPGP is a trust model that facilitates authentication decisions through a network of certifications and delegations. It is characterized by a so-called [strong set](https://en.wikipedia.org/wiki/Web_of_trust#Strong_set), which refers to a group of certificates that are robustly interconnected via third-party certifications. +The {term}`Web of Trust` in OpenPGP is a {term}`trust model` that facilitates {term}`authentication` decisions through a network of {term}`certifications` and {term}`delegations`. It is characterized by a so-called [strong set](https://en.wikipedia.org/wiki/Web_of_trust#Strong_set), which refers to a group of {term}`certificates` that are robustly interconnected via `third-party certifications`. -In this model, users independently delegate authentication decisions, choosing whose certification to rely on. This delegation is based on the certificates and third-party signatures available to them, with their OpenPGP software applying the Web of Trust mechanism to discern the reliability of each certificate for an identity. +In this model, users independently {term}`delegate` {term}`authentication` decisions, choosing whose {term}`certification` to rely on. This {term}`delegation` is based on the {term}`certificates` and {term}`third-party signatures` available to them, with their {term}`OpenPGP software` applying the {term}`Web of Trust` mechanism to discern the reliability of each {term}`certificate` for an {term}`identity`. -The OpenPGP RFC doesn't specify exactly how Web of Trust calculations are performed. It only defines the data formats on which these calculations can be performed. See external resources in {numref}`wot-resources`. +The {term}`OpenPGP RFC` doesn't specify exactly how {term}`Web of Trust` calculations are performed. It only defines the data formats on which these calculations can be performed. See external resources in {numref}`wot-resources`. ### Revoking third-party signatures -To reverse a previously issued third-party signature, the issuer can generate a [*certification revocation signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) (type ID `0x30`). The revocation must be issued by the same key that created the original signature or, in deprecated practice, by a designated [Revocation Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-revocation-key). +To reverse a previously issued {term}`third-party signature`, the {term}`issuer` can generate a [*certification revocation signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) ({term}`type ID` `0x30`). The {term}`revocation` must be issued by the same {term}`key` that created the original {term}`signature` or, in deprecated practice, by a designated [Revocation Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-revocation-key). ## Advanced topics ### Certification recipes -Different signatures in OpenPGP serve various specific purposes. This section provides practical guidance on creating these signatures, illustrating each with concrete examples. +Different {term}`signatures` in OpenPGP serve various specific purposes. This section provides practical guidance on creating these {term}`signatures`, illustrating each with concrete examples. +(change_algorithm_preferences)= #### Change algorithm preferences -To modify the preferred symmetric, compression, hash, or AEAD algorithms for a key, the key owner needs to issue a direct-key signature (type `0x1F`) on the primary key. +To modify the preferred {term}`symmetric`, compression, {term}`hash`, or {term}`AEAD algorithms` for a {term}`key`, the {term}`key owner` needs to issue a {term}`direct key signature` ({term}`type ID` `0x1F`) on the {term}`primary key`. -This signature should have the following structure: +This {term}`signature` should have the following structure: -| Subpacket | Area | Critical | Mandatory | Notes | -|---------------------------------|--------|----------------|-------------------|----------------------------------------------------| -| Signature Creation Time | Hashed | True | True | Current time | -| Issuer Fingerprint | Hashed | True or False | Strongly Recommended | The primary key is the issuer | -| Key Flags | Hashed | True | False | Retain key flags from the previous self-signature | -| Features | Hashed | True | False | Retain features from the previous self-signature | -| Key Expiration Time | Hashed | True | False | Retain expiration time from the previous self-signature, if applicable | -| Hash Algorithm Preferences | Hashed | False | False | New preferences | -| Compression Algorithm Preferences | Hashed | False | False | New preferences | -| Symmetric Algorithm Preferences | Hashed | False | False | New preferences | -| AEAD Algorithm Preferences | Hashed | False | False | New preferences | +| {term}`Subpacket` | Area | {term}`Critical` | Mandatory | Notes | +|---------------------------------------------------------------------------------------------|-----------------------------|------------------------------------------|----------------------|----------------------------------------------------------------------------------------| +| {term}`Signature Creation Time` | {term}`Hashed` | True | True | Current time | +| {term}`Issuer Fingerprint` | {term}`Hashed` | True or False | Strongly Recommended | The {term}`primary key` is the {term}`issuer` | +| {term}`Key Flags` | {term}`Hashed` | True | False | Retain {term}`key flags` from the previous {term}`self-signature` | +| {term}`Features` | {term}`Hashed` | True | False | Retain {term}`features` from the previous {term}`self-signature` | +| {term}`Key Expiration Time` | {term}`Hashed` | True | False | Retain {term}`expiration time` from the previous {term}`self-signature`, if applicable | +| {term}`Hash Algorithm Preferences` | {term}`Hashed` | False | False | New {term}`preferences` | +| {term}`Compression Algorithm Preferences` | {term}`Hashed` | False | False | New {term}`preferences` | +| {term}`Symmetric Algorithm Preferences` | {term}`Hashed` | False | False | New {term}`preferences` | +| {term}`AEAD Algorithm Preferences` | {term}`Hashed` | False | False | New {term}`preferences` | #### Change expiration time -To adjust the expiration time of an OpenPGP certificate, a new *DirectKey* signature (type `0x1F`) with a modified Key Expiration Time subpacket must be issued. The structure of this signature is identical to the one outlined in the previous section on changing algorithm preferences. +To adjust the {term}`expiration time` of an {term}`OpenPGP certificate`, a new *{term}`DirectKey`* {term}`signature` ({term}`type ID` `0x1F`) with a modified {term}`Key Expiration Time subpacket` must be issued. The structure of this {term}`signature` is identical to the one outlined in the previous section on changing {term}`algorithm preferences`. -Additionally, the expiration date can be altered for individual User IDs (detailed below) or separate subkeys (see {numref}`bind_subkey`). +Additionally, the {term}`expiration time` can be altered for individual {term}`User IDs` (detailed below) or separate {term}`subkeys` (see {numref}`bind_subkey`). #### Add User ID -To bind a User ID to an OpenPGP certificate a certification signature (type `0x10`-`0x13`) is used which should have the following structure: +To {term}`bind` a {term}`User ID` to an {term}`OpenPGP certificate` a {term}`certification signature` ({term}`type ID` `0x10`-`0x13`) is used which should have the following structure: -| Subpacket | Area | Critical | Mandatory | Notes | -|-------------------------|--------|----------------|-------------------|-------------------------------------------------| -| Signature Creation Time | Hashed | True | True | Current time | -| Issuer Fingerprint | Hashed | True or False | Strongly Recommended | The primary key is the issuer | -| Primary User ID | Hashed | True | False | Optional | -| Signature Expiration Time | Hashed | True | False | Optional | +| {term}`Subpacket` | Area | {term}`Critical` | Mandatory | Notes | +|------------------------------------------------------------------------|-----------------------------|------------------------------------------|----------------------|-------------------------------------------------------------------------------------| +| {term}`Signature Creation Time` | {term}`Hashed` | True | True | Current time | +| {term}`Issuer Fingerprint` | {term}`Hashed` | True or False | Strongly Recommended | The {term}`primary key` is the {term}`issuer` | +| {term}`Primary User ID` | {term}`Hashed` | True | False | Optional | +| {term}`Signature Expiration Time` | {term}`Hashed` | True | False | Optional | -In addition to these subpackets, self-certifications for User IDs can include others – such as key flags, features, and algorithm preferences – as shown in the previous table. This enables the specification of unique capabilities and preferences for each identity associated with the certificate. +In addition to these {term}`subpackets`, {term}`self-certifications` for {term}`User IDs` can include others – such as {term}`key flags`, {term}`features`, and {term}`algorithm preferences` – as shown in the previous table. This enables the specification of unique capabilities and {term}`preferences` for each {term}`identity` associated with the {term}`certificate`. #### Remove or revoke a User ID -Since OpenPGP certificates are often distributed by the means of key servers, new signatures on a certificate are often "merged" into existing copies of the certificate locally by the recipient. +Since {term}`OpenPGP certificates` are often distributed by the means of {term}`key servers`, new {term}`signatures` on a {term}`certificate` are often "merged" into existing copies of the {term}`certificate` locally by the recipient. ```{admonition} TODO :class: warning @@ -358,58 +337,58 @@ Since OpenPGP certificates are often distributed by the means of key servers, ne Link to the "Merging" section in chapter 4, once merged. ``` -This integration process means it is practically impossible to directly remove signatures or User IDs from a certificate, as there is no way to communicate the intention of packet deletion to the recipient. +This integration process means it is practically impossible to directly remove {term}`signatures` or {term}`User IDs` from a {term}`certificate`, as there is no way to communicate the intention of {term}`packet` deletion to the recipient. -To effectively mark a User ID as invalid, the user can publish a copy of their certificate with a *CertificationRevocation* signature (type `0x30`) attached to the invalidated User ID. This signature signals that the specified User ID is no longer valid or associated with the certificate holder. +To effectively mark a {term}`User ID` as invalid, the user can publish a copy of their {term}`certificate` with a {term}`Certification Revocation signature` ({term}`type ID` `0x30`) attached to the invalidated {term}`User ID`. This {term}`signature` signals that the specified {term}`User ID` is no longer valid or associated with the {term}`certificate holder`. -The structure of a *CertificationRevocation* is as follows: +The structure of a {term}`Certification Revocation signature` is as follows: -| Subpacket | Area | Critical | Mandatory | Notes | -|-------------------------|--------|----------------|-------------------|-------------------------------------------------| -| Signature Creation Time | Hashed | True | True | Current time | -| Issuer Fingerprint | Hashed | True or False | Strongly Recommended | The primary key is the issuer | -| Reason for Revocation | Hashed | True | False | Determines soft or hard revocation | +| {term}`Subpacket` | Area | {term}`Critical` | Mandatory | Notes | +|--------------------------------------------------------------------|-----------------------------|------------------------------------------|----------------------|-------------------------------------------------------------------------------------| +| {term}`Signature Creation Time` | {term}`Hashed` | True | True | Current time | +| {term}`Issuer Fingerprint` | {term}`Hashed` | True or False | Strongly Recommended | The {term}`primary key` is the {term}`issuer` | +| {term}`Reason for Revocation` | {term}`Hashed` | True | False | Determines {term}`soft` or {term}`hard revocation` | -For User ID revocations, the *Reason for Revocation* subpacket is crucial. A value of `0` means no specific reason, leading to a hard revocation, while `32` indicates the User ID is no longer valid, resulting in a soft revocation. Omitting the reason subpacket is also equivalent to a hard revocation. +For {term}`User ID` {term}`revocations`, the *{term}`Reason for Revocation`* {term}`subpacket` is crucial. A value of `0` means no specific reason, leading to a {term}`hard revocation`, while `32` indicates the {term}`User ID` is no longer valid, resulting in a {term}`soft revocation`. Omitting the {term}`reason subpacket` is also equivalent to a {term}`hard revocation`. -It is generally advisable to use reason code `32` for revoking User IDs. +It is generally advisable to use reason code `32` for revoking {term}`User IDs`. (binding_subkeys)= #### Add a subkey -As part of lifecycle management, users may need to add a new subkey to their OpenPGP certificate, often for reasons such as upgrading to a subkey with more advanced cryptographic algorithms. The process involves creating a specific signature structure: +As part of {term}`life-cycle management`, users may need to add a new {term}`subkey` to their {term}`OpenPGP certificate`, often for reasons such as upgrading to a {term}`subkey` with more advanced cryptographic algorithms. The process involves creating a specific {term}`signature` structure: -| Subpacket | Area | Critical | Mandatory | Notes | -|-------------------------------|--------|----------------|-------------------|-----------------------------------------------------| -| Signature Creation Time | Hashed | True | True | Current time | -| Issuer Fingerprint | Hashed | True or False | Strongly Recommended | The primary key is the issuer | -| Key Flags | Hashed | True | Strongly Recommended | Determine the usage of the key | -| Key Expiration Time | Hashed | True | False | Specifies the expiration date of the subkey | -| Embedded Signature | Hashed | True | If Key Flags contains **S** | Signing subkeys require embedded *Primary Key Binding* signature | -| Hash Algorithm Preferences | Hashed | False | False | Per key preferences | -| Compression Algorithm Preferences | Hashed | False | False | Per key preferences | -| Symmetric Algorithm Preferences | Hashed | False | False | Per key preferences | -| AEAD Algorithm Preferences | Hashed | False | False | Per key preferences | +| {term}`Subpacket` | Area | {term}`Critical` | Mandatory | Notes | +|---------------------------------------------------------------------------------------------|-----------------------------|------------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| {term}`Signature Creation Time` | {term}`Hashed` | True | True | Current time | +| {term}`Issuer Fingerprint` | {term}`Hashed` | True or False | Strongly Recommended | The {term}`primary key` is the {term}`issuer` | +| {term}`Key Flags` | {term}`Hashed` | True | Strongly Recommended | Determine the usage of the {term}`key` | +| {term}`Key Expiration Time` | {term}`Hashed` | True | False | Specifies the {term}`expiration time` of the {term}`subkey` | +| {term}`Embedded Signature` | {term}`Hashed` | True | If {term}`Key Flags` contains **{term}`S`** | {term}`Signing subkeys` require embedded *{term}`Primary Key Binding`* {term}`signature` | +| {term}`Hash Algorithm Preferences` | {term}`Hashed` | False | False | Per {term}`key` {term}`preferences` | +| {term}`Compression Algorithm Preferences` | {term}`Hashed` | False | False | Per {term}`key` {term}`preferences` | +| {term}`Symmetric Algorithm Preferences` | {term}`Hashed` | False | False | Per {term}`key` {term}`preferences` | +| {term}`AEAD Algorithm Preferences` | {term}`Hashed` | False | False | Per {term}`key` {term}`preferences` | -In addition to these subpackets, users can specify algorithm preferences for each subkey, distinct from those set in the certificate's *DirectKey* signature. +In addition to these {term}`subpackets`, users can specify {term}`algorithm preferences` for each {term}`subkey`, distinct from those set in the {term}`certificate`'s *{term}`Direct Key`* {term}`signature`. #### Revoke a subkey -Subkeys, like User IDs, can be individually revoked in OpenPGP. -This is done by issuing a `SubkeyRevocation` signature (type `0x28`) using the primary key. +{term}`Subkeys`, like {term}`User IDs`, can be individually revoked in OpenPGP. +This is done by issuing a {term}`Subkey Revocation signature` ({term}`type ID` `0x28`) using the {term}`primary key`. -The structure of such a signature is straightforward: +The structure of such a {term}`signature` is straightforward: -| Subpacket | Area | Critical | Mandatory | Notes | -|-------------------------|--------|----------------|-------------------|-------------------------------------------------| -| Signature Creation Time | Hashed | True | True | Current time | -| Issuer Fingerprint | Hashed | True or False | Strongly Recommended | The primary key is the issuer | -| Reason for Revocation | Hashed | True | False | Determines soft or hard revocation | +| {term}`Subpacket` | Area | {term}`Critical` | Mandatory | Notes | +|--------------------------------------------------------------------|-----------------------------|------------------------------------------|----------------------|-------------------------------------------------------------------------------------| +| {term}`Signature Creation Time` | {term}`Hashed` | True | True | Current time | +| {term}`Issuer Fingerprint` | {term}`Hashed` | True or False | Strongly Recommended | The {term}`primary key` is the {term}`issuer` | +| {term}`Reason for Revocation` | {term}`Hashed` | True | False | Determines {term}`soft` or {term}`hard revocation` | -In `SubkeyRevocation` signatures, the [reason for revocation](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation) subpacket can only have values in the range of `0-3`. The values `1` (key superseded) and `3` (key retired and no longer used) indicate soft revocations, whereas values `0` (no reason) and `2` (key compromised) indicate hard revocations. +In {term}`Subkey Revocation signatures`, the [reason for revocation](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation) {term}`subpacket` can only have values in the range of `0-3`. The values `1` ({term}`key` superseded) and `3` ({term}`key` retired and no longer used) indicate {term}`soft revocations`, whereas values `0` (no reason) and `2` ({term}`key` compromised) indicate {term}`hard revocations`. -Note that a value of `32` is not applicable in these signatures. +Note that a value of `32` is not applicable in these {term}`signatures`. ```{admonition} TODO :class: warning @@ -419,40 +398,40 @@ Research and explain hardness in the context of subkey revocations. What does a #### Revoke a certificate -Users may find themselves needing to revoke their entire OpenPGP certificate, rendering it unusable. This could be for various reasons, such as migrating to a new certificate or in response to a compromise of the certificate's secret key material. +Users may find themselves needing to revoke their entire {term}`OpenPGP certificate`, rendering it unusable. This could be for various reasons, such as migrating to a new {term}`certificate` or in response to a compromise of the {term}`certificate`'s {term}`secret key material`. -While a soft-revoked certificate can be re-validated at a later time with a new certification, a hard revocation is permanent. +While a {term}`soft-revoked` {term}`certificate` can be re-validated at a later time with a new {term}`certification`, a {term}`hard revocation` is permanent. -The recommended way to revoke a certificate is by issuing a *KeyRevocation* signature (type `0x20`). Its structure is similar to that of a *CertificationRevocation* signature. +The recommended way to {term}`revoke` a {term}`certificate` is by issuing a {term}`Key Revocation signature` ({term}`type ID` `0x20`). Its structure is similar to that of a {term}`Certification Revocation signature`. -| Subpacket | Area | Critical | Mandatory | Notes | -|-------------------------|--------|----------------|-------------------|-------------------------------------------------| -| Signature Creation Time | Hashed | True | True | Current time | -| Issuer Fingerprint | Hashed | True or False | Strongly Recommended | The primary key is the issuer | -| Reason for Revocation | Hashed | True | False | Determines soft or hard revocation | +| {term}`Subpacket` | Area | {term}`Critical` | Mandatory | Notes | +|--------------------------------------------------------------------|-----------------------------|------------------------------------------|----------------------|-------------------------------------------------------------------------------------| +| {term}`Signature Creation Time` | {term}`Hashed` | True | True | Current time | +| {term}`Issuer Fingerprint` | {term}`Hashed` | True or False | Strongly Recommended | The {term}`primary key` is the {term}`issuer` | +| {term}`Reason for Revocation` | {term}`Hashed` | True | False | Determines {term}`soft` or {term}`hard revocation` | -For *KeyRevocation* signatures, the guidelines regarding the [*Reason for Revocation* subpacket] (https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation) are the same as those for *SubkeyRevocation* signatures. +For {term}`Key Revocation signatures`, the guidelines regarding the [*Reason for Revocation* subpacket](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation) are the same as those for {term}`Subkey Revocation signatures`. #### Common subpackets in OpenPGP signatures -In OpenPGP, certain subpackets are universally expected across all types of signatures, serving fundamental roles in the signature's structure and verification: +In OpenPGP, certain {term}`subpackets` are universally expected across all types of {term}`signatures`, serving fundamental roles in the {term}`signature`'s structure, {term}`verification` and {term}`validation`: -* **Signature Creation Time**: This is a mandatory subpacket in every OpenPGP signature. It contains the timestamp of when the signature was created. For security and integrity, this subpacket must be located in the hashed area of the signature and is recommended to be marked as critical. +* **{term}`Signature Creation Time`**: This is a mandatory {term}`subpacket` in every {term}`OpenPGP signature`. It contains the timestamp of when the {term}`signature` was created. For security and integrity, this {term}`subpacket` must be located in the {term}`hashed area` of the {term}`signature` and is recommended to be marked as {term}`critical`. -* **Issuer Fingerprint**: Essential for signature verification, this subpacket identifies the key (or subkey) that was used to create the signature. OpenPGP v6 signatures should include the Issuer Fingerprint subpacket, containing the 32-byte fingerprint of the key. +* **{term}`Issuer Fingerprint`**: Essential for {term}`signature` {term}`validation`, this {term}`subpacket` identifies the {term}`key` (or {term}`subkey`) that was used to create the {term}`signature`. OpenPGP v6 {term}`signatures` should include the {term}`Issuer Fingerprint subpacket`, containing the 32-byte {term}`fingerprint` of the {term}`key`. ```{note} -The key used as the issuer in the signature might be a subkey of the certificate. +The {term}`key` used as the {term}`issuer` in the {term}`signature` might be a {term}`subkey` of the {term}`certificate`. ``` -This subpacket can be placed in either the hashed or unhashed area due to its self-authenticating nature. However, we recommend including it in the signature's hashed area. +These {term}`subpackets` can be placed in either the {term}`hashed` or {term}`unhashed area` due to its self-{term}`authenticating` nature. However, we recommend including them in the {term}`signature`'s {term}`hashed area`. ### Managing subpacket conflicts and duplication -In OpenPGP signatures, both the hashed and unhashed areas are composed of lists of subpackets. Inherently, this structure permits the duplication of the same subpacket, which could lead to conflicts. To manage these potential conflicts, the following strategies are used: +In {term}`OpenPGP signatures`, both the {term}`hashed` and {term}`unhashed areas` are composed of lists of {term}`subpackets`. Inherently, this structure permits the duplication of the same {term}`subpacket`, which could lead to conflicts. To manage these potential conflicts, the following strategies are used: -- **Precedence of hashed area**: Subpackets within the hashed area of a signature take precedence over those in the unhashed area. This hierarchy helps resolve conflicts when the same subpacket appears in both areas. +- **Precedence of {term}`hashed area`**: {term}`Subpackets` within the {term}`hashed area` of a {term}`signature` take precedence over those in the {term}`unhashed area`. This hierarchy helps resolve conflicts when the same {term}`subpacket` appears in both areas. -- **Handling conflicts within the same area**: Conflicts can still arise within the same area, such as when two subpackets have different expiration dates. In such cases, the [OpenPGP specification](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-notes-on-subpackets) advises that implementations should favor the last occurrence of a conflicting subpacket in the hashed area. +- **Handling conflicts within the same area**: Conflicts can still arise within the same area, such as when two {term}`subpackets` have different {term}`expiration times`. In such cases, the [OpenPGP specification](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-notes-on-subpackets) advises that {term}`implementations` should favor the last occurrence of a conflicting {term}`subpacket` in the {term}`hashed area`. -In certain scenarios, having duplicate subpackets with conflicting content is logical and even necessary. For example, consider a signature created by a version 4 issuer key, which was upgraded from an older OpenPGP version (like v3). Since the key ID calculation scheme changed from v3 to v4, the identifiers for the same key would differ between these versions. Therefore, a v4 signature might contain two issuer key ID subpackets, each with different, yet correct values for v3 and v4 keys, respectively. This allows for backward compatibility and ensures the signature can be validated under both key ID calculation schemes. +In certain scenarios, having duplicate {term}`subpackets` with conflicting content is logical and even necessary. For example, consider a {term}`signature` created by a version 4 {term}`issuer` {term}`key`, which was upgraded from an older OpenPGP version (like v3). Since the {term}`key ID` calculation scheme changed from v3 to v4, the identifiers for the same {term}`key` would differ between these versions. Therefore, a v4 signature might contain two {term}`issuer key ID subpackets`, each with different, yet correct values for v3 and v4 {term}`keys`, respectively. This allows for backward compatibility and ensures the {term}`signature` can be {term}`validated` under both {term}`key ID` calculation schemes. diff --git a/book/source/23-glossary.md b/book/source/23-glossary.md index 4819c9a..9749a4b 100644 --- a/book/source/23-glossary.md +++ b/book/source/23-glossary.md @@ -8,9 +8,25 @@ SPDX-License-Identifier: CC-BY-SA-4.0 ```{glossary} :sorted: +AEAD + See {term}`Authenticated Encryption With Associated Data`. + +AEAD Algorithm + See {term}`Authenticated Encryption With Associated Data`. + +Algorithm Preferences + The preferences for {term}`hash algorithms`, {term}`compression algorithms`, {term}`symmetric algorithms` and {term}`AEAD algorithms` are set using {term}`direct key signatures` or {term}`primary User ID` {term}`binding signatures`. + + See [](change_algorithm_preferences). + Asymmetric Cryptography Asymmetric cryptography is used in OpenPGP. For a more detailed discussion see [](public_key_asymmetric_cryptography). +Authenticated Encryption With Associated Data + Short AEAD, refers to an encryption scheme that ensures confidentiality of a message. Additionally, additional data, which is not confidential, may be associated with the message. + + See Wikipedia on [Authenticated Encryption](https://en.wikipedia.org/wiki/Authenticated_encryption). + Authentication The process of {term}`validiting` an {term}`identity claim`. The term "authentication" here is semantically different from the one used in {term}`Authentication Key Flag`. @@ -24,8 +40,19 @@ Authentication Tag Authenticity See {term}`Authentication`. +Back Signature + See {term}`Primary Key Binding Signature`. + +Binary Signature + A {term}`Data Signature` with the {term}`Signature Type ID` `0x00`, which is used for binary data. + +Binding + The process of creating a {term}`Binding Signature` for a {term}`Component`, or the resulting {term}`Binding Signature`. + + See {ref}`binding_sigs` for more. + Binding Signature - A {term}`signature` on a {term}`component` which links that {term}`component` to a {term}`certificate`. + A {term}`self-signature` on a {term}`component` which associates that {term}`component` to the issuing {term}`component key` in a {term}`certificate`. See {ref}`binding_sigs` for more. @@ -41,9 +68,6 @@ Certificate Certificate Authority See {term}`Certification Authority` -Certification Authority - Also known as [Certificate authority](https://en.wikipedia.org/wiki/Certificate_authority), this is an entity that handles digital certificates, especially by signing or issuing them. - Certificate Holder A person or other entity, that holds an {term}`Transferable Secret Key` and thus is able to modify the accompanying {term}`OpenPGP Certificate`. @@ -52,18 +76,45 @@ Certification Most commonly, the term is applied to "[third-party certifications](third_party_cert)," in which an external actor indicates that they have {term}`validated` the link between an {term}`identity` and a {term}`certificate`. However, the term is also used for [self-signatures that bind identity components](bind_ident) to a {term}`certificate`. +Certification Authority + Also known as [Certificate authority](https://en.wikipedia.org/wiki/Certificate_authority), this is an entity that handles digital certificates, especially by signing or issuing them. + Certification Key Flag A {term}`Key Flag`, indicating that a {term}`Component Key` can be used for issuing third-party {term}`certifications`. See [](capabilities_key_flags). +Certification Revocation Signature Packet + An {term}`OpenPGP Signature Packet` to {term}`revoke` an earlier {term}`self-certification` of a {term}`User ID`. + + [RFC 5.2.1.13](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) + +Certification Signature + See {term}`Certification`. + +Certifying Self-signature + An {term}`OpenPGP Signature Packet` by the {term}`Certificate Holder` on an {term}`Identity Component` of their own {term}`Certificate`. + +Certifying Signature + See {term}`Certification`. + Cipher Type Byte This historical term was defined in [RFC 1991](https://datatracker.ietf.org/doc/html/rfc1991#section-4.1) and was subsequently superseded by {term}`Packet Tag` in [RFC 2440](https://datatracker.ietf.org/doc/html/rfc2440#section-4.2), which is in turn superseded by {term}`Packet Type ID` in the new [RFC](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-packet-headers). +Cleartext Signature + A {term}`Data Signature` which exists in a combined text format, encapsulating the (readable) text input it was created for. See [](cleartext-sig). + +Cleartext Signature Framework + A framework for creating {term}`cleartext signatures`. + See [RFC 7](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#cleartext-signature). + Component An element in an {term}`OpenPGP Certificate`, that represents a {term}`component key` or {term}`identity component`. Component Key See {term}`OpenPGP Component Key`. +Compression + See {term}`Data Compression`. + Creation Time The point in time at which e.g. an {term}`OpenPGP Certificate`, or one of its {term}`component` is created. @@ -82,13 +133,33 @@ Cryptographic Signature CTB See {term}`Cipher Type Byte`. +Data Compression + The process of encoding information using fewer bits than the original representation. + In OpenPGP data compression is used to reduce the size required for encrypted messages. + + See Wikipedia on [Data Compression](https://en.wikipedia.org/wiki/Data_compression). + +Data Signature + {term}`Cryptographic signature` over binary documents or canonical text documents. See [](/07-signing_data). + +Data Signature Packet + An {term}`OpenPGP Signature Packet` which describes a {term}`Data Signature`. See [](/07-signing_data). + Delegation OpenPGP users can [delegate authentication decisions](delegation) to third parties, and thus rely on {term}`certifications` they issue. The remote party is then called a "{term}`trusted introducer`". This kind of delegation involves {term}`certifications` that include the {term}`trust signature` subpacket. +Detached Signature + A {term}`Data Signature` which exists as a separate file to the file it was created for. See [](forms_of_openpgp_data_signatures). + Direct Key Signature - A {term}`Signature` that sets preferences and advertises features applicable to an entire {term}`Certificate`. See [](direct_key_signature). + A {term}`Signature` that sets preferences and advertises {term}`features` applicable to an entire {term}`Certificate`. See [](direct_key_signature). + +Embedded Signature Subpacket + An {term}`OpenPGP Signature Subpacket` which contains a complete {term}`OpenPGP Signature Packet`. + + See [RFC 5.2.3.34](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-embedded-signature) Encryption Key Flag A {term}`Key Flag`, indicating that a {term}`Component Key` can be used for encrypting data. See [](capabilities_key_flags). @@ -96,18 +167,35 @@ Encryption Key Flag Expiration A mechanism by which a {term}`Component` is invalidated due to the {term}`Expiration Time` of its {term}`binding signature` being older than the {term}`Reference Time` by which it is validated. -Expiration Date Subpacket - An {term}`OpenPGP Signature Subpacket Type` which defines the {term}`Expiration Time` for an {term}`OpenPGP Signature Packet`. - Expiration Time The time of expiry of an {term}`OpenPGP Signature Packet`. +Features Subpacket + A {term}`OpenPGP Signature Subpacket`, which denotes advanced OpenPGP features an {term}`implementation` supports. + + For an in-depth view on these {term}`subpackets` see [](zooming_in_dks). + + See [RFC 5.2.3.32](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-features) + Fingerprint See {term}`OpenPGP Fingerprint`. +Hard Revocation + A {term}`Revocation Signature Packet` for a {term}`Certification` or a {term}`Component Key`, which either includes a {term}`Reason For Revocation Subpacket` with a {term}`Revocation Code`, that signifies the target being compromised (e.g., `0` or `2`), or has no {term}`Reason For Revocation Subpacket` at all. + + See [](hard_vs_soft_revocations). + + See [RFC 5.2.3.31](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation). + +Hash Algorithm + See {term}`Hash Function`. + Hash Digest Output of a cryptographic hash function for a string of data of any length. See [](crypto-hash). +Hash Function + A function used to map data of arbitrary size to fixed-size values (see {term}`Hash Digest`). + Hashed Area An area in an {term}`OpenPGP Signature Packet` containing {term}`OpenPGP Signature Subpacket`s, that is covered by the {term}`Hash Digest` a {term}`Cryptographic Signature` is created for. See [](hashed_and_unhashed_signature_subpackets). @@ -120,6 +208,9 @@ Hybrid Cryptosystem Identity An identity of a {term}`Certificate Holder`. It is represented by an {term}`Identity Component`, which may be certified using {term}`third-party identity certifications`, or by a {term}`Notation`. +Identity Certification + An {term}`OpenPGP Signature Packet` on an {term}`Identity Component` which {term}`certifies` its {term}`authenticity`. + Identity Claim A {term}`Certificate Holder` may use {term}`Identity Components` or {term}`Notations` to state a claim about their {term}`Identity`. @@ -129,12 +220,20 @@ Identity Component Identity Verification A process by which the {term}`Identity Claim` of a {term}`Certificate Holder` is verified. See also {term}`Signature Verification`. +Initial Introducer + An {term}`OpenPGP Certificate` explicitly {term}`delegated` to from a {term}`Trust Anchor`. + +Inline Signature + A {term}`Data Signature` which exists encapsulated alongside the data it was created for in an OpenPGP container. See [](forms_of_openpgp_data_signatures). + Issuer An entity, that created an {term}`OpenPGP Signature Packet` using an {term}`Transferable Secret Key`. Issuer Fingerprint Subpacket A {term}`Subpacket` specifying the {term}`Fingerprint` of an {term}`Issuer Key`. + See [RFC 5.2.3.35](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-issuer-fingerprint) + Issuer Key The {term}`OpenPGP Component Key` of an {term}`Issuer`, used to create an {term}`OpenPGP Signature Packet`. @@ -153,9 +252,17 @@ Key - OpenPGP component key - {term}`OpenPGP key` (which in turn refers to either an {term}`OpenPGP Certificate` or a {term}`Transferable Secret Key` +Key Expiration Time Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the {term}`Expiration Time` for an {term}`OpenPGP Signature Packet` on a {term}`key`. + + See [RFC 5.2.3.13](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-expiration-time) + Key Flag A preference encoded in an {term}`OpenPGP Signature Subpacket`, that defines the {term}`Capability` a {term}`OpenPGP Component Key` has. See [](signature_subpackets). +Key Holder + See {term}`Certificate Holder`. + Key ID The high-order (leftmost) 64 bits of an {term}`OpenPGP Fingerprint`. Historically, this term refers to the low-order (rightmost) 64 bits of an {term}`OpenPGP Fingerprint`. @@ -163,12 +270,24 @@ Key ID Key Material May refer to {term}`Public Key Material` or {term}`Private Key Material`. -Key Holder - See {term}`Certificate Holder`. - Key Owner See {term}`Certificate Holder`. +Key Revocation Signature Packet + A {term}`Revocation Self-signature` for an entire {term}`OpenPGP Certificate`. + +Key Server + A piece of software available over the network, which provides access to {term}`OpenPGP Certificates` e.g., by searching for an {term}`OpenPGP Fingerprint` or {term}`User ID`, via the `HKP` and/ or `HKPS` protocols. + Several implementations such as [hagrid](https://gitlab.com/keys.openpgp.org/hagrid/), or [hockeypuck](https://github.com/hockeypuck/hockeypuck) exist. + +Life-cycle Management + In OpenPGP several actions are necessary for the prolonged use of an {term}`OpenPGP Certificate` or adapting its {term}`components` to the requirements of the {term}`Certificate Holder`. + These are for example changes to {term}`binding signatures` (adding or {term}`revocation` of {term}`component keys` or {term}`direct key signature`), modification of {term}`expiration time` or other {term}`metadata` for {term}`components`. + See [](self-signatures). + +Literal Data Packet + A {term}`packet` in a {term}`Data Signature` which contains data, that has been signed using a {term}`cryptographic signature`. See [RFC 5.9](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#lit) for more details. + MAC See {term}`Message Authentication Code`. @@ -178,6 +297,9 @@ Master Key Message Authentication Code A piece of information used for integrity and {term}`authenticity` verification of a message. See [](message_authentication_codes). +Meta-Introducer + An {term}`OpenPGP Certificate` with a {term}`Trust Depth` greater than one. + Metadata Data related to preferences of an {term}`OpenPGP Certificate` or its {term}`Certificate Holder`, that can be found in {term}`signature` {term}`packets`. See [](metadata_in_certificates). @@ -190,6 +312,9 @@ Notation Signature Subpacket Notation Tag Part of a {term}`Notation` name. +One-pass Signature Packet + One or more {term}`packets` before the actual data in a {term}`Data Signature` which contain information to allow a receiving {term}`implementation` to create {term}`hashes` required for signature verification. See [RFC 5.4](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#one-pass-sig) for more details. + OpenPGP Certificate An OpenPGP certificate contains public key material, identity claims and third party certifications (but no private key material) @@ -207,6 +332,9 @@ OpenPGP Implementation OpenPGP Key Used either for an {term}`OpenPGP Certificate` (containing public key material and metadata), or for an {term}`OpenPGP Private Key`. See [](/04-certificates) for an in-depth discussion. +OpenPGP Message + A data structure, which contains OpenPGP components such as {term}`OpenPGP Certificate` or {term}`OpenPGP Signature Packet` and plaintext or encrypted data. + OpenPGP Public Key See {term}`OpenPGP Certificate`. @@ -231,6 +359,9 @@ OpenPGP Signature Subpacket Type OpenPGP Signature Type The type of an {term}`OpenPGP Signature Packet` is defined by its {term}`Signature Type ID`. See [](signature_types). +OpenPGP Signing Subkey + An {term}`OpenPGP Subkey` with the {term}`Signing Key Flag`. + OpenPGP Subkey An {term}`OpenPGP Component Key` that is used in the subkey role, in an {term}`OpenPGP Certificate`. For a more detailed discussion, see [](subkeys). @@ -249,14 +380,62 @@ Packet Tag Packet Type ID A numerical value encoded in the first octet of a {term}`Packet Header`, defining a {term}`Packet`'s type. +Positive Certification + An {term}`OpenPGP Signature Type` with the {term}`Signature Type ID` `0x13`, which is used in {term}`binding signatures` for {term}`User IDs`. This {term}`OpenPGP Signature Type` implies that the {term}`issuer` has done substantial {term}`verification` of the {term}`Identity Claim`. + + See [](bind_ident). + +Preferred Compression Algorithms Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the preferred {term}`compression algorithms` for an {term}`OpenPGP Signature Packet`. This defines which {term}`algorithms` the {term}`key holder` prefers to use. + + See [RFC 5.2.3.17](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-preferred-compression-algor). + +Preferred Hash Algorithms Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the preferred {term}`hash algorithm` for an {term}`OpenPGP Signature Packet`. This defines which algorithms the {term}`key holder` prefers to receive. + + See [RFC 5.2.3.16](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-preferred-hash-algorithms). + +Preferred Symmetric Ciphers for v1 SEIPD Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the preferred version 1 {term}`SEIPD` algorithms for an {term}`OpenPGP Signature Packet`. This defines which algorithms the {term}`key holder` prefers to receive and implicitly signifies the supported algorithms of the {term}`key holder`'s {term}`implementation`. + + See [RFC 5.2.3.14](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-preferred-symmetric-ciphers). + +Preferred AEAD Ciphersuites Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the preferred version 2 {term}`SEIPD` algorithms for an {term}`OpenPGP Signature Packet`. This defines which algorithms the {term}`key holder` prefers to receive and implicitly signifies the supported algorithms of the {term}`key holder`'s {term}`implementation`. + + See [RFC 5.2.3.15](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-preferred-aead-ciphersuites) + + Primary Component Key See {term}`OpenPGP Primary Key`. +Primary Introducer + See {term}`Initial Introducer`. + Primary Key See {term}`OpenPGP Primary Key`. +Primary Key Binding Signature + A {term}`Binding Signature`, which is created by a {term}`OpenPGP Signing Subkey` on the {term}`OpenPGP Primary Key` of an {term}`OpenPGP Certificate` and stored in an {term}`Embedded Signature Subpacket` in the {term}`Binding Signature` for the {term}`OpenPGP Signing Subkey`. + + This special case is explained in more detail in [](bind_subkey_sign). + Primary User ID - A {term}`User ID` which carries the default preferences for {term}`identity components` without preferences. See [](primary_user_id). + A {term}`User ID` which carries the default preferences for {term}`identity components` without preferences. + + See [](primary_user_id). + +Primary User ID Subpacket + An {term}`OpenPGP Signature Subpacket` used in {term}`User ID self-signatures` which allows to signify whether the {term}`User ID` in question is considered a {term}`Primary User ID`. + + See [RFC 5.2.3.27](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#primary-user-id-subpacket) + +Primary User ID Binding Signature + A {term}`Binding Signature`, which is created by an {term}`OpenPGP Primary Key` to bind a {term}`User ID` to its {term}`OpenPGP Certificate` and marking it as the {term}`Primary User ID`. + + This {term}`Binding Signature` may carry {term}`metadata` specific to the {term}`User ID` at hand as well as some applicable to the entire {term}`OpenPGP Certificate`. + + See [](self_signature_binding_to_primary_user_id). Private Key See {term}`Transferable Secret Key`. @@ -276,32 +455,88 @@ Public Key Cryptography Public Key Material See {term}`OpenPGP Certificate`. +Reason For Revocation Subpacket + An {term}`OpenPGP Signature Subpacket`, which is used in {term}`Certification Revocation Signature Packet` and {term}`key revocation signature packets` to describe a reason for the {term}`revocation`. + + See [RFC 5.2.3.31](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation) + Reference Time A point in time at which an {term}`OpenPGP Certificate` is evaluated. -Revocation - Mechanism to invalidate a {term}`component` or an entire {term}`OpenPGP Certificate`. See [](revocations). +Regular Expression Subpacket + An {term}`OpenPGP Signature Subpacket` which allows for limiting {term}`delegations` to {term}`identities` matching a regular expression. -Revocation certificate - A type of {term}`signature` that invalidates a previous statement made via a {term}`signature` +Revocation + Mechanism to invalidate a {term}`component` or an entire {term}`OpenPGP Certificate` using a {term}`Revocation Self-signature`. See [](revocations). + +Revocation Certificate + A {term}`Revocation Self-signature` for an {term}`OpenPGP Primary Key` distributed alongside the plain {term}`OpenPGP Primary Key`. + + See [RFC 10.1.2](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-openpgp-v6-revocation-certi) + + Note that in [OpenPGP v4 this term is typically used](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#section-10.1.3-6) for a bare {term}`Revocation Self-signature` {term}`packet`. + +Revocation Code + A number in a {term}`Reason For Revocation Subpacket` which represents the reason for a {term}`Revocation`. + +Revocation Self-signature + A class of {term}`self-signatures` to {term}`revoke` {term}`primary keys`, {term}`User IDs` or {term}`User Attributes` and invalidate {term}`subkey binding signatures`. + + See [](self-revocations). + +Revocation Signature + See {term}`Revocation Signature Packet`. + +Revocation Signature Packet + An {term}`OpenPGP Signature Packet` used for the {term}`revocation` of a {term}`certification` or {term}`binding`. + + Revocation signatures are often {term}`self-signatures`, more specifically {term}`revocation self-signatures`. + However, *{term}`certification revocations`* can be both {term}`self-signatures` or {term}`third-party signatures`. + Additionally, with the deprecated *Revocation Key* mechanism, {term}`third-party` *Key-* and *Subkey revocations* also exist. RFC This document, unless noted otherwise, refers to the [OpenPGP version 6 specification](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/) when referring to *RFC*. +SEIPD + See {term}`Symmetrically Encrypted Integrity Protected Data`. + +Self-certification + A {term}`certification` on a {term}`component` of an {term}`OpenPGP Certificate` issued by a {term}`component key` of the same {term}`OpenPGP certificate`. + +Secret Key Material + See {term}`Private Key Material`. + Self-signature An {term}`OpenPGP Signature Packet` by the {term}`Certificate Holder` on a {term}`Component` of their own {term}`Certificate`. Session Key A unique shared secret used in encryption in a {term}`Hybrid Cryptosystem`. See {ref}`encryption_chapter` and {ref}`decryption_chapter`. +Soft Revocation + A {term}`Revocation Signature Packet` for a {term}`Certification` or a {term}`Component Key`, which includes a {term}`Reason For Revocation Subpacket` with a {term}`Revocation Code`, that does not signify the target being compromised (e.g., `0` or `2`). + + See [](hard_vs_soft_revocations). + + See [RFC 5.2.3.31](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-reason-for-revocation). + Signature See {term}`OpenPGP Signature Packet`. +Signature Creation Time Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the {term}`Creation Time` for an {term}`OpenPGP Signature Packet`. + + See [RFC 5.2.3.11](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-creation-time) + +Signature Expiration Time Subpacket + An {term}`OpenPGP Signature Subpacket Type` which defines the {term}`Expiration Time` for an {term}`OpenPGP Signature Packet`. + + See [RFC 5.2.3.18](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-signature-expiration-time) + Signature On Component {term}`Cryptographic signature` associated with {term}`Component Keys` or {term}`Identity Components`. See [](/08-signing_components). Signature Over Data - {term}`Cryptographic signature` over binary documents or canonical text documents. See [](/07-signing_data). + See {term}`Data Signature`. Signature Packet See {term}`OpenPGP Signature Packet`. @@ -324,12 +559,35 @@ Signature Verification Signer A {term}`Certificate Holder`, that is able to create {term}`self-signatures` and {term}`third-party signatures`. +Signing-capable + See {term}`Signing Key Flag`. + Signing Key Flag A {term}`Key Flag`, indicating that a {term}`Component Key` can be used for signing data. See [](capabilities_key_flags). +Signing Subkey + See {term}`OpenPGP Signing Subkey`. + +Strong Authentication + "Strong Authentication" in this text refers to having ascertained that a {term}`certificate` and an {term}`identity claim` on it are legitimately linked. That is, that the person who controls the {term}`certificate` is correctly represented by the {term}`identity component`. + + Strong authentication in OpenPGP is typically encoded with a {term}`certification signature`. + + Ascertaining strong authentication requires an out-of-band check: Either via a manual {term}`verification` process, or an automated system that can {term}`certify` that a user has identified to the system that issues the {term}`identity` in question (e.g. an email provider can {term}`certify` email-based {term}`identities` that it issues to the user). + + Also see {term}`Authentication`. + Subkey See {term}`OpenPGP Subkey`. +Subkey Binding Signature + A {term}`Self-signature` to associate an {term}`OpenPGP Subkey` with an {term}`OpenPGP Primary Key`. See [](bind_subkey). + +Subkey Revocation Signature Packet + A {term}`Self-signature` to {term}`revoke` an {term}`OpenPGP Subkey` in an {term}`OpenPGP Certificate`. + + See [RFC 5.2.1.12](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-subkey-revocation-signature) + Subpacket See {term}`OpenPGP Signature Subpacket`. @@ -339,9 +597,17 @@ Subpacket Type Symmetric Cryptography Symmetric cryptography is used in OpenPGP. For a more detailed discussion see [](symmetric_key_cryptography). +Symmetrically Encrypted Integrity Protected Data + Short *SEIPD*, this refers to {term}`Symmetric Cryptography` based encrypted data, which is used in a Symmetrically Encrypted Integrity Protected Data Packet. + + See [RFC 5.13](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-symmetrically-encrypted-int). + Symmetric Secret Key The {term}`Private Key Material` used in {term}`Symmetric Cryptography`. +Text Signature + A {term}`signature packet` with the {term}`Signature Type ID` `0x01`, which is used for textual data. + Third-party Identity Certification {term}`Certification` by third-parties to confirm ownership of an {term}`OpenPGP Certificate` by a {term}`Certificate Holder`. See [](third_party_identity_certifications). @@ -351,11 +617,34 @@ Third-party Signature Transferable Secret Key A Transferable Secret Key (TSK) is the combination of an {term}`OpenPGP Certificate` and the associated {term}`private key material`. Also often referred to as an "OpenPGP private key". It is discussed in detail in [](/05-private). +Trust Amount + A numerical value between `0` and `255`, stored in {term}`trust signatures` used for indicating the degree of reliance on the {term}`delegation`. + Values less than `120` indicate partial trust, values equal to or greater than `120` indicate complete trust. + + See [](trust_amounts). + See [RFC 5.2.3.21](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-trust-signature) + +Trust Anchor + An entity in a {term}`Trust Model` for which trust is assumed and not derived. + +Trust Depth + This numerical value is part of a {term}`Trust Signature` and describes the extent of trustworthiness of a {term}`Certification`, that the {term}`signer` assigns to it. + + See [](trust_depth_level). + +Trust Level + See {term}`Trust Depth`. + Trust Model A model by which trust between {term}`identities` associated with different {term}`OpenPGP Certificates` is created. See [](third_party_identity_certifications). -Trust signature - The *trust signature* subpacket on a certifying {term}`signature` is used for {term}`delegation` of {term}`authentication` decisions. With this feature, an OpenPGP user can designate a {term}`certificate` as a "{term}`trusted introducer`" and opt to rely on {term}`certifications` they issue. +Trust Root + See {term}`Trust Anchor`. + +Trust Signature + The *trust signature* {term}`subpacket` on a {term}`certifying signature` is used for {term}`delegation` of {term}`authentication` decisions. With this feature, an OpenPGP user can designate a {term}`certificate` as a "{term}`trusted introducer`" and opt to rely on {term}`certifications` they issue. + + See [RFC 5.2.3.21](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-trust-signature) Trusted introducer OpenPGP users can choose to rely on {term}`certifications` issued by a third party. The remote party of such a {term}`delegation` is called a "trusted introducer". @@ -377,9 +666,15 @@ Unhashed Area Unhashed Subpacket A {term}`Signature Subpacket` residing in the {term}`Unhashed Area` of a {term}`Signature Packet`. +User Attribute + An {term}`Identity Component`, which may hold a single JPEG image. See [](user_attributes). + User ID An {term}`Identity Component`, which describes an {term}`Identity` of a {term}`Certificate Holder`. See [](user_ids_in_openpgp_certificates). +User ID Binding Signature + A {term}`Binding Signature`, which is created by an {term}`OpenPGP Primary Key` to bind a {term}`User ID` to an {term}`OpenPGP Certificate`. + Validation A mechanism by which the [operational needs of a use-case are met](https://en.wikipedia.org/wiki/Verification_and_validation#Validation). In OpenPGP terminology this may refer to processes such as ensuring, that an {term}`OpenPGP Signature Packet` has been created after a {term}`Transferable Secret Key`'s {term}`Creation Time`, but before its {term}`Expiration Time`. @@ -390,4 +685,7 @@ Validity Verification A mechanism by which the [compliance with design specifications are met](https://en.wikipedia.org/wiki/Verification_and_validation#Verification). In OpenPGP terminology this may refer to e.g. {term}`Signature Verification` or {term}`Identity Verification`. + +Web Of Trust + A {term}`trust model` which is based on a network of {term}`certifications` and {term}`delegations`, that can be used to discern the reliability of {term}`certificates` and their associated {term}`identities`. See [](wot). ```