TOFU for GnuPG

[Neal H. Walfield]

Hi Andre,

At Fri, 30 Oct 2015 13:23:14 +0100,
Andre Heinecke wrote:
> On Thursday 29 October 2015 22:28:54 Neal H. Walfield wrote:
> > At Thu, 29 Oct 2015 18:48:43 +0100,
> > 
> > Johannes Zarl-Zierl wrote:
> > > Out of curiosity: Does the TOFU implementation for gpg already allow for
> > > key transition statements / is this planned for some point in the future?
> > Unfortunately, it doesn't.  This is because there is currently no
> > standard way to communicate the id of the new key.  I've proposed a
> > solution for this for the next OpenPGP version, which is currently
> > being work on.  There appears to be some interest, but unfortunately I
> > haven't had time to work on that recently.
> 
> I don't fully understand why you need formalized transition statements. 
> Couldn't you just treat Key / UIDs that are signed by each other as "two valid 
> keys for this UID"?
> 
> So when I transition to another key I just sign it with the old key and GnuPG 
> can detect that and not show a warning about it?
> 
> This would also solve the problem that some users may have multiple keys with 
> the same UID's which are both valid.

This could work if both keys are available locally.  If you need to
look up the new key, this is not so easy.

Another problem is that this assumes that the new key has the exact
same user ids.  Oftentimes some emails will have been dropped or the
person's name changed (e.g., marriage, new title, etc.).

Thanks,

:) Neal