Extending the key expiration date

[David Shaw]

On Wed, Sep 05, 2001 at 08:08:39PM +0200, Florian Weimer wrote:
> David Shaw <dshaw@jabberwocky.com> writes:
> 
> > On Wed, Sep 05, 2001 at 08:39:35AM +0200, Florian Weimer wrote:
> > > Subba Rao <subba9@home.com> writes:
> > > 
> > > > Is it possible to edit the expiration date of the current key?
> > > 
> > > Yes, it's even possible without invalidating certificates.  This is a
> > > known design flaw in OpenPGP.
> > 
> > I wouldn't call it a flaw.  I'd call that a feature :) Having to
> > revoke the self-signature and put a new one in place will lead to huge
> > trails of self-signatures followed by certificate revocations followed
> > by more self-signatures every time the user changed their preferences.
> 
> Eh, sorry, I don't see the relevance of this in the light of key
> expiration times.

Ah, I just twigged to the confusion.  I was discussing self-signatures
because the key expiration time is contained in the self-signature.
Changing the expiration time of the key involves changing the
self-signature.

My point was that it is a Good Thing that OpenPGP allows
self-signature replacement in-place, rather than forcing a revocation
and new signature.  Otherwise, every time you change the key
expiration time (or any key preferences, actually), the key will gain
a revocation and signature.  After a while, that makes for a really
huge key.

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson