choosing an encryption target from a User ID

[Daniel Kahn Gillmor]

when encrypting messages to a user ID with multiple matching keys with
full calculated validity, gpg seems to just choose the "first" matching
key, for some definition of "first" -- i think it's decided by
chronological age of first import into the local keyring.

This does not seem to be the best heuristic.  here are some other
proposed heuristics for choosing among multiple keys with full
calculated User ID validity during encryption:

 0) choose the most recently-created key

 1) choose the key with the strongest supported encryption-capable
subkey (by bitlength?)

 2) encrypt to *all* matching keys

The current implementation does what seems to be the Wrong Thing in the
use case where the recipient is going through a key transition, and has
two keys (one older, deprecated but not yet expired; and one newer,
stronger, preferred).

Any thoughts on this?  Should i open it as a ticket?

	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 891 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20090922/07a938b5/attachment.pgp>