Expired signature

[Atom 'Smasher']

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 8 Jun 2004, David Shaw wrote:

> On Tue, Jun 08, 2004 at 10:06:57AM -0400, Atom 'Smasher' wrote:
>
> > since i use expiration dates on my keys, and plan to update the
> > expiration dates if they're still being used, i ~really~ wish the
> > _default_ for signing keys was "no expiration" instead of expiring
> > with the key....  there doesn't seem to be any harm in having a
> > valid (non-expired) signature on an expired key.
> >
> > if i *really* own my keys now, it seems safe to assume that i'll
> > still own them even after the current expiration date, especially if
> > i update the expiration date on the keys.
>
> Why is it safe to assume that?
>
> Some people look at a key expiration date as a statement by you:
> "After xxxx date, I do not vouch for my own key".  Given that, why on
> earth should someone else vouch for it longer than you do?
====================

my own intent in using a key with an expiration is:
  1) if i lose the secret key, password, and revocation certificate, the
	key will remove itself from circulation and not contribute to the
	pollution of abandoned valid keys.
  2) any update to my key (preferences, UIDs, subkeys, revocation) *will*
	be noticed on or about the expiration date.


> This is an unresolvable debate since neither side is entirely wrong
> and neither side is entirely right.  The current behavior in GnuPG is
> the more conservative of the two choices, as is proper for a default.
====================

as things are, i can't debate your logic: it's solid.

the problem is that the protocol can't distinguish between different
*intentions* when using a self-sig with an expiration. maybe if a self-sig
0x13 could mean that "i have every intention of maintaining and renewing
this key after the expiration date", while a 'lessor' self-sig could mean
that "after the expiration date, i don't even trust this key myself."
since different levels of signing exist for signing other peoples' keys,
it wouldn't seem to big of a stretch for a self signature to make use of
those levels (0x10 - 0x13) but define them differently for self-sigs.

of course, that would require a change to the way that self-sigs are
generated and checked... maybe there would be less problems declaring such
intentions using notation data? that might be a useful start for the (as
yet unused) IETF/OpenPGP notation namespace.

*if* something like that were adopted into the OpenPGP protocol, would it
be reasonable for a key that declares "i have every intention of
maintaining and renewing this key after the expiration date" to cause
key-signatures to ~default~ to not expire?

until then, what if signing a key with an expiration didn't default to
anything, but *required* a manual selection of whether or not to expire
the signature with the key?


	...atom

 _________________________________________
 PGP key - http://atom.smasher.org/pgp.txt
 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
 -------------------------------------------------

	"You can't hold a man down without staying down with him."
		-- Booker T Washington
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
Comment: What is this gibberish?  -  http://atom.smasher.org/links/#digital_signatures

iEYEARECAAYFAkDGPz4ACgkQnCgLvz19QePHjQCfVdHa2oI1bIXFoCeNWnEoj1rp
mi0AmwRy27FcVduz9w6h1ql+e6rrPu9n
=Pn4E
-----END PGP SIGNATURE-----