Hi, As you may have read (and probably forgotten about it), OpenPGP has diverged into two incompatible standards a while ago [1]. Unfortunately, it doesn't seem that time is going to heal wounds here, and today we're still in this mess. On top of that, it has been recently pointed out [2] that GLEP 63 wording of "v4 or later" can confuse people into believing we permit both incompatible v5 and v6 versions. While we could just have changed that into "v4 only", it seems more appropriate to discuss the wider issue.
Long story short, there are two standards now: LibrePGP [3], which is pretty much the final version of Werner Koch's RFC4880bis, and RFC9580 [4]. They are both based on the old RFC4880 [5], which corresponds to the v4 message format. However, while RFC4880bis defined a v5 message format, RFC9580 rejected it and defined a v6 format instead. As you may have guessed, GnuPG is obstinately rejecting RFC9580. Other projects are split between either implementing RFC9580, or both. There is a FreePG patchset [6] that is used by a bunch of major distros to improve GnuPG compatibility, but that's hardly a solution (we are apparently considering adding it a separate package [7]). At this point, I don't think there's any production-ready, portable alternative to GnuPG for us -- particularly with Sequoia being limited by Rust's limited platform support. What I think makes sense right now is to update GLEP 63 to require RFC4880 compliant keys, with some explicitly permitted extensions (like curve 25519 support). However, I don't really consider myself an expert here, and I still think we need a more general idea of how to go forward from here. [1] https://lwn.net/Articles/953797/ [2] https://bugs.gentoo.org/963069 [3] https://librepgp.org/ [4] https://www.rfc-editor.org/rfc/rfc9580.html [5] https://www.rfc-editor.org/rfc/rfc4880.html [6] https://freepg.org/ [7] https://bugs.gentoo.org/950668 -- Best regards, Michał Górny
signature.asc
Description: This is a digitally signed message part
