mirror of
https://codeberg.org/openpgp/notes.git
synced 2024-11-23 08:02:05 +01:00
Merge pull request 'tammi-ch4' (#81) from tammi-ch4 into draft
Reviewed-on: https://codeberg.org/openpgp/notes/pulls/81
This commit is contained in:
heiko
commit
30f23eb37e
4 changed files with 376 additions and 176 deletions
BIN
.DS_Store
vendored
Normal file
BIN
.DS_Store
vendored
Normal file
Binary file not shown.
|
|
@ -6,7 +6,7 @@ SPDX-License-Identifier: CC-BY-SA-4.0
|
||||||
(certificates_chapter)=
|
(certificates_chapter)=
|
||||||
# Certificates
|
# Certificates
|
||||||
|
|
||||||
OpenPGP fundamentally hinges on the concept of "OpenPGP certificates," often referred to as "OpenPGP keys." These certificates are complex data structures essential for identity verification, data encryption, and digital signatures. Understanding their structure and functionality is pivotal for effective application of the OpenPGP standard.
|
OpenPGP fundamentally hinges on the concept of "OpenPGP certificates," also known as "OpenPGP keys." These certificates are complex data structures essential for identity verification, data encryption, and digital signatures. Understanding their structure and function is pivotal to effectively applying the OpenPGP standard.
|
||||||
|
|
||||||
## Terminology: Understanding "keys"
|
## Terminology: Understanding "keys"
|
||||||
|
|
||||||
|
|
@ -26,117 +26,114 @@ In OpenPGP, the term "key" may refer to three distinct layers, each serving a un
|
||||||
|
|
||||||
The following section will delve into the OpenPGP-specific layers (2 and 3) to provide a clearer understanding of their roles within OpenPGP certificates.
|
The following section will delve into the OpenPGP-specific layers (2 and 3) to provide a clearer understanding of their roles within OpenPGP certificates.
|
||||||
|
|
||||||
For detailed insights on structure and handling, refer to our chapters on OpenPGP [certificates](certificates_chapter) and [private keys](private_key_chapter). Additionally, managing certificates, and understanding their authentication and trust models are vital topics. While this document briefly touches upon these aspects, they are integral to working proficiently with OpenPGP.
|
For a discussion of private key material in OpenPGP, see the chapter {ref}`private_key_chapter`. Bindings that connect the components of a certificate are discussed in our chapter {ref}`certifications_chapter`. For much more detail on the internal (packet) structure of certificates and keys refer to our chapter {ref}`zoom_certificates`. Additionally, managing certificates, and understanding their authentication and trust models are vital topics. While this document briefly touches upon these aspects, they are integral to working proficiently with OpenPGP.
|
||||||
|
|
||||||
## Components of an OpenPGP certificate
|
## Structure of OpenPGP certificates
|
||||||
|
|
||||||
An OpenPGP certificate (or "OpenPGP key") is a collection of an arbitrary number of elements[^packets]:
|
An OpenPGP certificate (or "OpenPGP key") is a collection of an arbitrary number of elements[^packets]:
|
||||||
|
|
||||||
[^packets]: In technical terms, the elements of an OpenPGP certificate are a collection "packets". Each component key and identity component is internally represented as one packet. The other common type of element is "signature" packets, which link the components of a certificate together.
|
[^packets]: In technical terms, the elements of an OpenPGP certificate are a collection of "packets." Each component key and identity component is internally represented as a packet. Another common type of packet is the "signature" packet, which connect the components of a certificate.
|
||||||
|
|
||||||
- Component OpenPGP keys,
|
- Component keys
|
||||||
- Identity components,
|
- Identity components
|
||||||
- Other metadata (this includes connections between the certificate's components).
|
- Additional metadata, including connections between the certificate's components
|
||||||
|
|
||||||
We sometimes collectively refer to component keys and identity information as "the components of a certificate."
|
This documentation collectively refers to component keys and identity components as "the components of a certificate."
|
||||||
|
|
||||||
```{figure} diag/OpenPGP_Certificate.png
|
```{figure} diag/OpenPGP_Certificate.png
|
||||||
|
|
||||||
Typical components in an OpenPGP certificate
|
Typical components in an OpenPGP certificate
|
||||||
```
|
```
|
||||||
|
|
||||||
All elements in an OpenPGP certificate are structured around one central component: the *OpenPGP primary key*. The primary key acts as a personal {term}`CA` for the certificate's owner: It can make cryptographic statements about subkeys, identities, expiration, revocation, ...
|
Every element in an OpenPGP certificate revolves around a central component: the *OpenPGP primary key*. The primary key acts as a personal CA (Certification Authority) for the certificate's owner, enabling cryptographic statements regarding subkeys, identities, expiration, revocation, and more.
|
||||||
|
|
||||||
```{note}
|
```{note}
|
||||||
OpenPGP certificates are typically long-lived and may be changed (typically by their owner), over time. Components can be added and invalidated, over the lifetime of a certificate
|
OpenPGP certificates tend to have a long lifespan, with the potential for modifications (typically by their owner) over time. Components may be added or invalidated throughout a certificate's lifetime.
|
||||||
```
|
```
|
||||||
|
|
||||||
## Component keys
|
## Component keys
|
||||||
|
|
||||||
An OpenPGP certificate usually contains multiple OpenPGP component keys. Component keys are used in one of two roles: either as "OpenPGP primary key," or as an "OpenPGP subkey."
|
An OpenPGP certificate usually contains multiple component keys. Component keys serve in one of two roles: either as an "OpenPGP primary key" or as an "OpenPGP subkey."
|
||||||
|
|
||||||
OpenPGP component keys logically consist of an [asymmetric cryptographic keypair](asymmetric_key_pair) and a creation timestamp. These attributes of a component key cannot be changed after creation (in the case of ECDH keys, two additional parameters are part of a component key's constituting data[^ecdh-paramters]).
|
OpenPGP component keys logically consist of an [asymmetric cryptographic keypair](asymmetric_key_pair) and a creation timestamp. Once created, these attributes of a component key remain fixed (for ECDH keys, two additional parameters are part of a component key's constitutive data[^ecdh-parameters]).
|
||||||
|
|
||||||
[^ecdh-paramters]: For [ECDH](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-algorithm-specific-part-for-ecd) component keys, two additional algorithm parameters are part of the component key's constituting and immutable properties. Those parameters define a hash function and a symmetric encryption algorithm.
|
[^ecdh-parameters]: For [ECDH](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-algorithm-specific-part-for-ecd) component keys, two additional algorithm parameters are integral to the component key's constitutive and immutable properties. Those parameters specify a hash function and a symmetric encryption algorithm.
|
||||||
|
|
||||||
```{figure} diag/Component_Key.svg
|
```{figure} diag/Component_Key.svg
|
||||||
|
|
||||||
An OpenPGP component key
|
An OpenPGP component key
|
||||||
```
|
```
|
||||||
|
|
||||||
Component key representations that include private key material also contain metadata that specifies the password protection scheme for the private key material. However, in this chapter, we're looking at *OpenPGP certificates*, which *don't* contain private key information. Each component key of such a certificate contains only the public part of its cryptographic key data. To read more about private keys in OpenPGP, see {numref}`private_key_chapter`.
|
In OpenPGP, component keys containing private key material also include metadata specifying the password protection scheme. This is another facet of metadata, akin to the aforementioned creation timestamp and additional parameters for certain algorithms. However, this discussion focuses on OpenPGP certificates, in which the component keys contain only the public part of its cryptographic key data. For information on private keys in OpenPGP, see {numref}`private_key_chapter`.
|
||||||
|
|
||||||
### Fingerprint
|
### Fingerprint
|
||||||
|
|
||||||
For each OpenPGP component key, an *OpenPGP fingerprint* can be derived from the combination of the public key material and creation timestamp (and ECDH parameters, if applicable).
|
Each OpenPGP component key possesses an *OpenPGP fingerprint*. This fingerprint is derived from the public key material, the creation timestamp, and, when relevant, the ECDH parameters.
|
||||||
|
|
||||||
```{figure} diag/Fingerprint.png
|
```{figure} diag/Fingerprint.png
|
||||||
|
|
||||||
Every OpenPGP component key can be named by a fingerprint
|
Every OpenPGP component key is identifiable by a fingerprint. Although it's technically possible for different keys to share a fingerprint, cryptographic mechanisms make it exceedingly difficult, if not practically impossible with current technology, to find keys that share a fingerprint.
|
||||||
```
|
```
|
||||||
|
|
||||||
The fingerprint of our example component OpenPGP key is `C0A5 8384 A438 E5A1 4F73 7124 26A4 D45D BAEE F4A3 9E6B 30B0 9D55 13F9 78AC CA94`[^keyid].
|
The fingerprint of our example OpenPGP component key is `C0A5 8384 A438 E5A1 4F73 7124 26A4 D45D BAEE F4A3 9E6B 30B0 9D55 13F9 78AC CA94`[^keyid].
|
||||||
|
|
||||||
[^keyid]: In OpenPGP version 4, the rightmost 64 bit were sometimes used as a shorter identifier, called "Key ID".
|
[^keyid]: In OpenPGP version 4, the rightmost 64 bits were sometimes used as a shorter identifier, called "Key ID."
|
||||||
E.g., an OpenPGP version 4 certificate with the fingerprint `B3D2 7B09 FBA4 1235 2B41 8972 C8B8 6AC4 2455 4239` might be referred to by the 64 bit Key ID `C8B8 6AC4 2455 4239` or styled as `0xC8B86AC424554239`.
|
For example, an OpenPGP version 4 certificate with the fingerprint `B3D2 7B09 FBA4 1235 2B41 8972 C8B8 6AC4 2455 4239` might be referenced by the 64-bit Key ID `C8B8 6AC4 2455 4239` or formatted as `0xC8B86AC424554239`.
|
||||||
Historically, even shorter 32 bit identifiers have sometimes been used, like this: `2455 4239`, or `0x24554239`. You may still see such identifiers in very old documents about PGP. However, 32 bit identifiers have [been unfit for purpose for a long time](https://evil32.com/). At some point, 32 bit identifiers were called "short Key ID", while 64 bit identifiers were called "long Key ID".
|
Historically, even shorter 32-bit identifiers were used, like this: `2455 4239`, or `0x24554239`. Such identifiers still appear in very old documents about PGP. However, [32-bit identifiers have been long deemed unfit for purpose](https://evil32.com/). At one point, 32-bit identifiers were called "short Key ID," while 64-bit identifiers were referred to as "long Key ID."
|
||||||
|
|
||||||
### Primary key
|
### Primary key
|
||||||
|
|
||||||
The "OpenPGP primary key" is a component key that serves a central role in an OpenPGP certificate:
|
The OpenPGP primary key is a component key that serves a distinct, central role in an OpenPGP certificate:
|
||||||
|
|
||||||
- Its fingerprint is used as the unique identifier for the full OpenPGP certificate.
|
- Its fingerprint acts as an identifier for the entire OpenPGP certificate.
|
||||||
- It is used for lifecycle operations, such as adding or invalidating subkeys or identities in a certificate.
|
- It facilitates lifecycle operations, such as adding or invalidating subkeys or identities within a certificate.
|
||||||
|
|
||||||
The validity of the primary key limits its capacity to confer validity to other components. E.g.: The primary key cannot confer an expiration time beyond its own expiration to a subkey. It can also not confer validity to components after it has been revoked.
|
|
||||||
|
|
||||||
```{admonition} Terminology
|
```{admonition} Terminology
|
||||||
:class: note
|
:class: note
|
||||||
|
|
||||||
In the RFC, the OpenPGP primary key is also sometimes referred to as "top-level key." It has also sometimes informally been called "master key."
|
In the RFC, the OpenPGP primary key is occasionally referred to as "top-level key." Informally, it has also been termed the "master key."
|
||||||
```
|
```
|
||||||
|
|
||||||
### Subkeys
|
### Subkeys
|
||||||
|
|
||||||
In addition to the primary key, modern OpenPGP certificates usually contain a number of "subkeys" (however, it's not technically necessary for a certificate to contain subkeys).
|
Modern OpenPGP certificates typically include several subkeys in addition to the primary key, although these subkeys are optional.
|
||||||
|
|
||||||
Subkeys have the same structure as the primary key, but they are used in a different role. Subkeys are cryptographically linked with the primary key (more on this in {numref}`binding_subkeys`).
|
While subkeys have the same structural attributes as the primary key, they fulfill different roles. Subkeys are cryptographically linked with the primary key, a relationship further discussed in {numref}`binding_subkeys`.
|
||||||
|
|
||||||
```{figure} diag/Subkeys.png
|
```{figure} diag/Subkeys.png
|
||||||
:name: Certificate with Subkeys
|
:name: Certificate with subkeys
|
||||||
:alt: Three component keys. The primary key is shown at the top. It can be used for certification. Below it, linked with arrows, are two more component keys, used as subkeys. They are marked as "for encryption" and "for signing", respectively.
|
:alt: Diagram depicting three component keys. The primary key is positioned at the top, designated for certification. Below it, connected by arrows, are two subkeys labeled as "for encryption" and "for signing," respectively.
|
||||||
|
|
||||||
OpenPGP certificates can contain a number of subkeys
|
OpenPGP certificates can contain multiple subkeys.
|
||||||
```
|
```
|
||||||
|
|
||||||
### Key flags: defining which operations a component key can perform
|
#### Defining operational capabilities with key flags
|
||||||
|
|
||||||
Each component key has a set of ["Key Flags"](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#key-flags) that specify which operations that key can perform.
|
Each component key has a set of ["key flags"](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#key-flags) that delineate the operations a key can perform.
|
||||||
|
|
||||||
The commonly used key flags are:
|
Commonly used key flags include:
|
||||||
|
|
||||||
- **C**ertification (issuing third-party certifications)
|
- **Certification**: enables issuing third-party certifications
|
||||||
- **S**igning (signing data)
|
- **Signing**: allows the key to sign data
|
||||||
- **E**ncryption (encrypting data)
|
- **Encryption**: allows the key to encrypt data
|
||||||
- **A**uthentication (commonly used for OpenPGP authentication)
|
- **Authentication**: primarily used for OpenPGP authentication
|
||||||
|
|
||||||
By convention, only the primary key is allowed to perform "certification" operations. All other operations can be configured on either the primary key or a subkey.
|
|
||||||
|
|
||||||
```{note}
|
```{note}
|
||||||
|
Distinct component keys handle specific operations. Only the primary key can be used for certification, although it can have additional capabilities. Subkeys can be used for signing, encryption, and authentication but cannot have the certification capability. It is considered good practice, however, to [use separate keys for each capability](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#section-10.1.5-7).
|
||||||
|
|
||||||
It is considered good practice to have separate component keys for each type of operation: to allow only *Certification* operations with the primary key, and to use separate *Signing*, *Encryption* and *Authentication* subkeys (independently: with most algorithms, encryption can't be shared with the other capabilities[^key-flag-sharing]).
|
Notably, in many algorithms, encryption and signing-related functionalities (i.e., certification, signing, authentication) are mutually exclusive, because the algorithms only support one of those two families of operations[^key-flag-sharing]).
|
||||||
```
|
```
|
||||||
|
|
||||||
[^key-flag-sharing]: With ECC algorithms, it's actually not possible to share encryption functionality with the signing-based functionalities, e.g.: ed25519 used for signing; cv25519 used for encryption.
|
[^key-flag-sharing]: With ECC algorithms, it's impossible to combine encryption functions with those intended for signing. For example, ed25519 is specifically used for signing; cv25519 is designated for encryption.
|
||||||
|
|
||||||
### Component key metadata, including key flags
|
### Component key metadata, including key flags
|
||||||
|
|
||||||
The key flags for a component key are actually not defined *inside* that component key itself.
|
The key flags for a component key are not stored within the component key directly.
|
||||||
|
|
||||||
Instead, key flags, together with other metadata about that component key (such as the key expiration time), are stored using mechanisms that join components together as an OpenPGP certificate:
|
Instead, key flags, along with other metadata about that component key, such as the key expiration time, are stored using mechanisms that bind components into an OpenPGP certificate:
|
||||||
|
|
||||||
- For the primary key, two different mechanisms can be used to define its key flags (as well as other metadata): That configuration can be associated with the [Primary User ID](primary_user_id), or via a [direct key signature](direct_key_signature).
|
- For the primary key, its key flags and other metadata can be defined in two ways: they can be linked with the [Primary User ID](primary_user_id) or through a [direct key signature](direct_key_signature).
|
||||||
- For subkeys, their key flags (and other metadata) are defined with the mechanism that connects the subkey with the certificate (via the primary key). More on that [below](binding_subkeys).
|
- For subkeys, the key flags and other metadata are set using the mechanism that binds the subkey to the certificate, specifically through the primary key. Further details on [binding subkeys](binding_subkeys) are below.
|
||||||
|
|
||||||
|
|
||||||
(identity_components)=
|
(identity_components)=
|
||||||
|
|
@ -144,52 +141,61 @@ Instead, key flags, together with other metadata about that component key (such
|
||||||
|
|
||||||
Identity components in an OpenPGP certificate are used by the certificate holder to state that they are known by a certain identifier (like a name, or an email address).
|
Identity components in an OpenPGP certificate are used by the certificate holder to state that they are known by a certain identifier (like a name, or an email address).
|
||||||
|
|
||||||
### User IDs
|
### User IDs in OpenPGP certificates
|
||||||
|
|
||||||
An OpenPGP certificate can contain any number of [User IDs](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-user-id-packet-tag-13). Each User ID associates the certificate with an identity.
|
OpenPGP certificates can contain multiple [User IDs](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-user-id-packet-tag-13). Each User ID associates the certificate with an identity.
|
||||||
|
|
||||||
```{figure} diag/user_ids.png
|
```{figure} diag/user_ids.png
|
||||||
|
|
||||||
OpenPGP certificates can contain any number of User IDs
|
OpenPGP certificates can contain any number of User IDs
|
||||||
```
|
```
|
||||||
|
|
||||||
Often, identities in a User ID consist of a UTF-8 encoded string that is composed of a name and an email address. By convention, User IDs typically consist of an [RFC2822](https://www.rfc-editor.org/rfc/rfc2822) *name-addr*.
|
```{admonition} Warning
|
||||||
|
This image could be visually improved! The new image should have an alt tag
|
||||||
|
```
|
||||||
|
|
||||||
Also see [draft-dkg-openpgp-userid-conventions-00](https://datatracker.ietf.org/doc/draft-dkg-openpgp-userid-conventions/), 25 August 2023.
|
A typical User ID identity is a UTF-8-encoded string composed of a name and an email address. By convention, User IDs align with the format described in [RFC2822](https://www.rfc-editor.org/rfc/rfc2822) as a *name-addr*.
|
||||||
|
|
||||||
|
For further conventions on User IDs, refer to the document [draft-dkg-openpgp-userid-conventions-00](https://datatracker.ietf.org/doc/draft-dkg-openpgp-userid-conventions/), dated 25 August 2023.
|
||||||
|
|
||||||
One proposed variant for encoding identities in User ID is to use ["split User IDs"](https://dkg.fifthhorseman.net/blog/2021-dkg-openpgp-transition.html#split-user-ids).
|
One proposed variant for encoding identities in User ID is to use ["split User IDs"](https://dkg.fifthhorseman.net/blog/2021-dkg-openpgp-transition.html#split-user-ids).
|
||||||
|
|
||||||
|
```{admonition} Warning
|
||||||
|
Heiko, please clarify what the value is of this proposal or remove it.
|
||||||
|
```
|
||||||
|
|
||||||
(primary_user_id)=
|
(primary_user_id)=
|
||||||
### Primary User ID and its implications
|
### Implimations of the Primary User ID
|
||||||
|
|
||||||
One User ID in a certificate has the special property of being the [Primary User ID](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-primary-user-id).
|
Within a certificate, a specific User ID is desginated as the [Primary User ID](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-primary-user-id).
|
||||||
|
|
||||||
User IDs are associated with preference settings (such as preferred encryption algorithms, more on this in {numref}`zooming_in_user_id`). The preferences associated with the Primary User ID are used by default.
|
Each User ID carries associated preference settings, such as preferred encryption algorithms, which is detailed in {numref}`zooming_in_user_id`). The preferences associated with the Primary User ID take precedence by default.
|
||||||
|
|
||||||
```{admonition} TODO
|
```{admonition} TODO
|
||||||
:class: warning
|
:class: warning
|
||||||
|
|
||||||
i think crypto-refresh suggests that the direct key signature should hold the default preferences?
|
i think crypto-refresh suggests that the direct key signature should hold the default preferences?
|
||||||
we might need to write a more nuanced text here, about how DKS and primary user id interact in v6, and mention the differences to v4?
|
we might need to write a more nuanced text here, about how DKS and primary user id interact in v6, and mention the differences to v4?
|
||||||
|
|
||||||
|
the primary User ID can also specify metadata about the primary key
|
||||||
```
|
```
|
||||||
|
|
||||||
### User attributes
|
### User attributes in OpenPGP
|
||||||
|
While
|
||||||
|
[user attributes](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-user-attribute-packet-tag-1) are similar to User IDs, they are less commonly used.
|
||||||
|
|
||||||
[User attributes](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-user-attribute-packet-tag-1) are similar to User IDs, but less commonly used.
|
Currently, the OpenPGP standard prescribes only one format to be stored in user attributes: an [image](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-the-image-attribute-subpack). Typically, this image represents the key owner, although it is not required.
|
||||||
|
|
||||||
The OpenPGP standard currently only defines one format to store in User Attributes: an [image](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-the-image-attribute-subpack), "presumably (but not required to be) that of the key owner".
|
|
||||||
|
|
||||||
## Linking the components
|
## Linking the components
|
||||||
|
|
||||||
To form an OpenPGP certificate out of a collection of components, the certificate holder links these components together (using their OpenPGP software).
|
To form an OpenPGP certificate, individual components are interconnected by the certificate holder using their OpenPGP software. Within OpenPGP, this process is termed "binding," as in "a subkey is bound to the primary key." These bindings are realized using cryptographic signatures. An in-depth discussion of this topic can be found in {ref}`component_signatures_chapter`).
|
||||||
|
|
||||||
The OpenPGP term for linking components is "binding," as in: "a subkey is bound to the primary key." The bindings are realized using cryptographic signatures (much more details about this are in {ref}`component_signatures_chapter`).
|
In very abstract terms, the primary key of a certificate acts as a root of trust or "certification authority." It is responsible for:
|
||||||
|
|
||||||
In very abstract terms, the primary key of a certificate acts as a root of trust for that certificate (as a kind of "certification authority"):
|
- issuing signatures that express the certificate holder's intent to use specific subkeys or identity components;
|
||||||
|
- conducting other lifecycle operations, including setting expiration dates and marking components as invalidated or "revoked."
|
||||||
|
|
||||||
The primary key issues signatures that express the certificate holder's intent to use subkeys or identity components. It also performs other lifecycle operations, such as setting expiration times, or marking components as invalidated ("revoked").
|
By binding components using digital signatures, recipients of an OpenPGP certificate need only validate the authenticity of the primary key to use for their communication partner. Traditionally, this is done by manually verifying the *fingerprint* of the primary key. Once the validity of the primary key is confirmed, the validity of the remaining components can be automatically assessed by the user's OpenPGP software. Generally, components are valid parts of a certificate if there is a statement signed by the certificate's primary key endorsing this validity.
|
||||||
|
|
||||||
Binding components together with digital signatures means that recipients of an OpenPGP certificate only need to verify that the primary key is the correct one to use for their communication partner (traditionally, this has often been done by manually verifying the *fingerprint* of the primary key). Once the validity of the primary key is established, the validity of all other components can be automatically determined by the user's OpenPGP software. To a first estimation, components are valid parts of a certificate if there is a statement signed with the certificate's primary key that expresses this validity.
|
|
||||||
|
|
||||||
## Revocations
|
## Revocations
|
||||||
|
|
||||||
|
|
@ -199,18 +205,33 @@ Binding components together with digital signatures means that recipients of an
|
||||||
This section needs to be written
|
This section needs to be written
|
||||||
```
|
```
|
||||||
|
|
||||||
## Third party (identity) certifications
|
## Third-party (identity) certifications
|
||||||
|
|
||||||
```{admonition} TODO
|
```{admonition} TODO
|
||||||
:class: warning
|
:class: warning
|
||||||
|
|
||||||
This section needs writing
|
This section needs to be written
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Third-party identity certifications have historically played a pivotal role in the OpenPGP ecosystem.
|
||||||
|
|
||||||
In the past, the SKS keyserver network has accepted third party signatures and added them to certificates without any limitations. This has caused problems: anyone can add a large number of certifications to some certificates, which opens the door to a type of "vandalism", by growing certificates unreasonably, and making them annoying to use[^flooding].
|
### Security considerations
|
||||||
|
|
||||||
[^flooding]: Storing third-party identity certifications in the target OpenPGP certificate is convenient for consumers: it is easy to find all relevant certifications in one central location. However, when third parties can unilaterally add certifications, this opens an avenue for denial-of-service attacks by flooding. The SKS network of OpenPGP key servers [allowed and experienced this problem](https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html).
|
While a convenience for consumers, indiscriminately accepting and integrating third-party identity certifications comes with significant risks.
|
||||||
|
|
||||||
|
Without any restrictions in place, malicious entities can flood a certificate with excessive certifications. Called "certificate flooding," this form of digital vandalism grossly expands the certificate size, making the certificate cumbersome and impractical for users.
|
||||||
|
|
||||||
|
It also opens the door to potential denial-of-service attacks, rendering the certificate non-functional or significantly impeding its operation.
|
||||||
|
|
||||||
|
The popular [SKS keyserver network experienced certificate flooding firsthand](https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html), causing it to shut down operations in 2019.
|
||||||
|
|
||||||
|
### Improved mechanisms in OpenPGP v6
|
||||||
|
|
||||||
|
```{admonition} TODO
|
||||||
|
:class: warning
|
||||||
|
|
||||||
|
This section needs to be written
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
## Advanced topics
|
## Advanced topics
|
||||||
|
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB After Width: | Height: | Size: 52 KiB |
|
|
@ -1,125 +1,304 @@
|
||||||
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
||||||
<!-- Created with Inkscape (http://www.inkscape.org/) -->
|
|
||||||
|
|
||||||
<svg
|
<svg
|
||||||
width="68mm"
|
viewBox="0 0 660.56769 379.09162"
|
||||||
height="42.769001mm"
|
|
||||||
viewBox="0 0 67.999999 42.769001"
|
|
||||||
version="1.1"
|
version="1.1"
|
||||||
id="svg895"
|
id="svg1"
|
||||||
|
sodipodi:docname="diag_library_draft.svg"
|
||||||
inkscape:version="1.3 (0e150ed6c4, 2023-07-21)"
|
inkscape:version="1.3 (0e150ed6c4, 2023-07-21)"
|
||||||
sodipodi:docname="fingerprint.svg"
|
width="660.56769"
|
||||||
inkscape:export-filename="fingerprint.png"
|
height="379.09161"
|
||||||
inkscape:export-xdpi="128"
|
xml:space="preserve"
|
||||||
inkscape:export-ydpi="128"
|
|
||||||
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
|
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
|
||||||
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
|
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
|
||||||
xmlns="http://www.w3.org/2000/svg"
|
xmlns="http://www.w3.org/2000/svg"
|
||||||
xmlns:svg="http://www.w3.org/2000/svg">
|
xmlns:svg="http://www.w3.org/2000/svg"><defs
|
||||||
<sodipodi:namedview
|
id="defs1"><marker
|
||||||
id="namedview897"
|
style="overflow:visible"
|
||||||
|
id="Square"
|
||||||
|
refX="0"
|
||||||
|
refY="0"
|
||||||
|
orient="auto"
|
||||||
|
inkscape:stockid="Square"
|
||||||
|
markerWidth="1"
|
||||||
|
markerHeight="1"
|
||||||
|
viewBox="0 0 1 1"
|
||||||
|
inkscape:isstock="true"
|
||||||
|
inkscape:collect="always"
|
||||||
|
preserveAspectRatio="xMidYMid"><path
|
||||||
|
transform="scale(0.5)"
|
||||||
|
style="fill:context-stroke;fill-rule:evenodd;stroke:none"
|
||||||
|
d="M -5,-5 V 5 H 5 V -5 Z"
|
||||||
|
id="path18" /></marker><linearGradient
|
||||||
|
id="swatch251"
|
||||||
|
inkscape:swatch="solid"><stop
|
||||||
|
style="stop-color:#195962;stop-opacity:1;"
|
||||||
|
offset="0"
|
||||||
|
id="stop251" /></linearGradient><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect66-9"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect35-9-9"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1 @ F,0,1,1,0,18.14255,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><inkscape:path-effect
|
||||||
|
effect="fillet_chamfer"
|
||||||
|
id="path-effect32-1-8"
|
||||||
|
is_visible="true"
|
||||||
|
lpeversion="1"
|
||||||
|
nodesatellites_param="F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 | F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 | F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1 @ F,0,0,1,0,0,0,1"
|
||||||
|
radius="0"
|
||||||
|
unit="px"
|
||||||
|
method="auto"
|
||||||
|
mode="F"
|
||||||
|
chamfer_steps="1"
|
||||||
|
flexible="false"
|
||||||
|
use_knot_distance="true"
|
||||||
|
apply_no_radius="true"
|
||||||
|
apply_with_radius="true"
|
||||||
|
only_selected="false"
|
||||||
|
hide_knots="false" /><filter
|
||||||
|
style="color-interpolation-filters:sRGB"
|
||||||
|
inkscape:label="Drop Shadow"
|
||||||
|
id="filter90"
|
||||||
|
x="-0.02018661"
|
||||||
|
y="-0.031382764"
|
||||||
|
width="1.0434854"
|
||||||
|
height="1.070755"><feFlood
|
||||||
|
result="flood"
|
||||||
|
in="SourceGraphic"
|
||||||
|
flood-opacity="0.796078"
|
||||||
|
flood-color="rgb(62,67,73)"
|
||||||
|
id="feFlood89" /><feGaussianBlur
|
||||||
|
result="blur"
|
||||||
|
in="SourceGraphic"
|
||||||
|
stdDeviation="2.132 0"
|
||||||
|
id="feGaussianBlur89" /><feOffset
|
||||||
|
result="offset"
|
||||||
|
in="blur"
|
||||||
|
dx="1.000000"
|
||||||
|
dy="1.000000"
|
||||||
|
id="feOffset89" /><feComposite
|
||||||
|
result="comp1"
|
||||||
|
operator="in"
|
||||||
|
in="flood"
|
||||||
|
in2="offset"
|
||||||
|
id="feComposite89" /><feComposite
|
||||||
|
result="fbSourceGraphic"
|
||||||
|
operator="over"
|
||||||
|
in="SourceGraphic"
|
||||||
|
in2="comp1"
|
||||||
|
id="feComposite90" /><feColorMatrix
|
||||||
|
result="fbSourceGraphicAlpha"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
values="0 0 0 -1 0 0 0 0 -1 0 0 0 0 -1 0 0 0 0 1 0"
|
||||||
|
id="feColorMatrix90" /><feFlood
|
||||||
|
id="feFlood90"
|
||||||
|
result="flood"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
flood-opacity="0.796078"
|
||||||
|
flood-color="rgb(62,67,73)" /><feGaussianBlur
|
||||||
|
id="feGaussianBlur90"
|
||||||
|
result="blur"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
stdDeviation="3.000000" /><feOffset
|
||||||
|
id="feOffset90"
|
||||||
|
result="offset"
|
||||||
|
in="blur"
|
||||||
|
dx="1.000000"
|
||||||
|
dy="1.000000" /><feComposite
|
||||||
|
id="feComposite91"
|
||||||
|
result="comp1"
|
||||||
|
operator="in"
|
||||||
|
in="flood"
|
||||||
|
in2="offset" /><feComposite
|
||||||
|
id="feComposite92"
|
||||||
|
result="comp2"
|
||||||
|
operator="over"
|
||||||
|
in="fbSourceGraphic"
|
||||||
|
in2="comp1" /></filter></defs><sodipodi:namedview
|
||||||
|
id="namedview1"
|
||||||
pagecolor="#ffffff"
|
pagecolor="#ffffff"
|
||||||
bordercolor="#000000"
|
bordercolor="#000000"
|
||||||
borderopacity="0.25"
|
borderopacity="0.25"
|
||||||
inkscape:showpageshadow="2"
|
inkscape:showpageshadow="2"
|
||||||
inkscape:pageopacity="1"
|
inkscape:pageopacity="0.0"
|
||||||
inkscape:pagecheckerboard="0"
|
inkscape:pagecheckerboard="0"
|
||||||
inkscape:deskcolor="#d1d1d1"
|
inkscape:deskcolor="#d1d1d1"
|
||||||
inkscape:document-units="mm"
|
inkscape:lockguides="false"
|
||||||
showgrid="false"
|
inkscape:zoom="1"
|
||||||
inkscape:zoom="2.7684424"
|
inkscape:cx="1453.5"
|
||||||
inkscape:cx="51.111773"
|
inkscape:cy="730.5"
|
||||||
inkscape:cy="113.78239"
|
inkscape:window-width="2560"
|
||||||
inkscape:window-width="956"
|
inkscape:window-height="1371"
|
||||||
inkscape:window-height="972"
|
|
||||||
inkscape:window-x="0"
|
inkscape:window-x="0"
|
||||||
inkscape:window-y="0"
|
inkscape:window-y="305"
|
||||||
inkscape:window-maximized="1"
|
inkscape:window-maximized="1"
|
||||||
inkscape:current-layer="layer1"
|
inkscape:current-layer="g40"
|
||||||
inkscape:export-bgcolor="#ffffffff" />
|
showgrid="false"
|
||||||
<defs
|
inkscape:export-bgcolor="#ffffff00"
|
||||||
id="defs892" />
|
showguides="false"><inkscape:page
|
||||||
<g
|
x="2.5476957e-08"
|
||||||
inkscape:label="Layer 1"
|
y="4.1418102e-06"
|
||||||
|
width="660.56769"
|
||||||
|
height="379.09161"
|
||||||
|
id="page66"
|
||||||
|
margin="0"
|
||||||
|
bleed="0" /></sodipodi:namedview><!--! Font Awesome Pro 6.4.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license (Commercial License) Copyright 2023 Fonticons, Inc. --><g
|
||||||
inkscape:groupmode="layer"
|
inkscape:groupmode="layer"
|
||||||
id="layer1"
|
id="layer5"
|
||||||
transform="translate(-64.804822,-64.571863)">
|
inkscape:label="Chapter 4"
|
||||||
<rect
|
inkscape:highlight-color="#baa600"
|
||||||
style="fill:#0f6cdb;fill-opacity:0.432801;stroke:none;stroke-width:0.11409;stroke-opacity:0.3512"
|
transform="translate(-811.81226,-1223.9908)"><g
|
||||||
id="rect2546"
|
inkscape:groupmode="layer"
|
||||||
width="32.196262"
|
id="layer7"
|
||||||
height="5.5284286"
|
inkscape:label="Component Key"
|
||||||
x="82.806755"
|
transform="translate(11.236271,-4.7700578)"
|
||||||
y="85.749054" />
|
style="display:inline"><path
|
||||||
<path
|
style="opacity:1;mix-blend-mode:normal;fill:#ffffff;fill-opacity:1;stroke:#e6e6e6;stroke-width:1.312;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke;filter:url(#filter90)"
|
||||||
style="fill:#008000;stroke-width:0.055678"
|
id="rect65-3"
|
||||||
inkscape:connector-curvature="0"
|
width="642.6438"
|
||||||
d="m 103.72732,70.960828 c -0.0755,-0.06413 -0.17341,-0.100289 -0.27457,-0.09921 h -8.838079 c -0.235714,-0.583441 -0.5875,-1.118749 -1.045896,-1.577145 -0.895819,-0.89582 -2.0881,-1.389296 -3.354486,-1.39088 -1.26604,6.02e-4 -2.457373,0.493837 -3.353723,1.390187 -0.896767,0.896767 -1.388432,2.086771 -1.389649,3.354217 -7.14e-4,2.616882 2.126624,4.744757 4.743457,4.743852 1.268733,1.42e-4 2.459253,-0.491545 3.355561,-1.387852 0.458495,-0.458495 0.808449,-0.993471 1.044891,-1.578121 l 2.904569,0.0011 c 0.11992,-7.07e-4 0.23137,-0.04871 0.31449,-0.13749 l 0.763364,-0.818936 0.767167,0.81907 c 0.0816,0.08579 0.192867,0.137292 0.313037,0.13626 0.11787,0.0012 0.23242,-0.04858 0.3123,-0.135304 l 0.766987,-0.821142 0.76375,0.820739 c 0.0816,0.0858 0.19502,0.135623 0.31293,0.13686 0.11985,-7.78e-4 0.22232,-0.03918 0.31462,-0.137362 l 0.76508,-0.819099 0.76584,0.818872 c 0.083,0.09287 0.20473,0.140092 0.32764,0.137179 0.11066,-0.0053 0.21137,-0.0492 0.28758,-0.125412 0.0106,-0.01061 0.0217,-0.02257 0.0312,-0.0355 l 1.07973,-1.349485 c 0.14624,-0.182024 0.11927,-0.448037 -0.0593,-0.598432 z m -14.322492,1.677547 c -4.03e-4,0.745736 -0.603551,1.348884 -1.348509,1.348509 -0.745637,3.5e-5 -1.348686,-0.603013 -1.348283,-1.348283 -1.48e-4,-0.744732 0.602462,-1.348049 1.348396,-1.348622 0.744725,7.1e-5 1.347923,0.603735 1.348396,1.348396 z m 13.386862,-0.53955 c 0,0.08867 -0.0372,0.170172 -0.095,0.227922 -0.0578,0.05777 -0.13928,0.09501 -0.22792,0.09498 l -7.52091,-0.0011 c -0.0083,-0.217556 -0.03183,-0.431575 -0.07029,-0.642944 l 7.59213,-7.63e-4 c 0.17725,-7e-6 0.32194,0.144681 0.32197,0.321896 z"
|
height="250.32849"
|
||||||
id="path4600-8-0-6-5-1-3" />
|
x="825.70776"
|
||||||
<text
|
y="875.02576"
|
||||||
xml:space="preserve"
|
transform="matrix(0.90039676,0,0,1.2175633,97.177615,208.49295)"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.52778px;font-family:'Courier 10 Pitch';-inkscape-font-specification:'Courier 10 Pitch, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;opacity:1;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
inkscape:path-effect="#path-effect66-9"
|
||||||
x="83.26268"
|
sodipodi:type="rect"
|
||||||
y="89.55616"
|
d="m 851.7972,875.02576 h 590.4649 c 14.4536,0 26.0895,8.60482 26.0895,19.29332 v 211.74182 c 0,10.6885 -11.6359,19.2933 -26.0895,19.2933 H 851.7972 c -14.45355,0 -26.08944,-8.6048 -26.08944,-19.2933 V 894.31908 c 0,-10.6885 11.63589,-19.29332 26.08944,-19.29332 z"
|
||||||
id="text4813"><tspan
|
ry="19.293327"
|
||||||
sodipodi:role="line"
|
rx="26.089437" /><g
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.52778px;font-family:'Courier 10 Pitch';-inkscape-font-specification:'Courier 10 Pitch, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
id="g11-8-3"
|
||||||
x="83.26268"
|
transform="matrix(0.86376245,0,0,0.86376245,109.50803,1110.3706)"
|
||||||
y="89.55616"
|
inkscape:label="Diagramm Header"
|
||||||
id="tspan1029">- Key creation time</tspan><tspan
|
style="display:inline;fill:#61a78d;fill-opacity:1"><rect
|
||||||
sodipodi:role="line"
|
style="font-variation-settings:'wght' 700;fill:#195962;stroke-width:2.471;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.52778px;font-family:'Courier 10 Pitch';-inkscape-font-specification:'Courier 10 Pitch, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
id="rect1-9-8"
|
||||||
x="83.26268"
|
width="329.94476"
|
||||||
y="93.965881"
|
height="57.886284"
|
||||||
id="tspan2137" /><tspan
|
x="914.89185"
|
||||||
sodipodi:role="line"
|
y="156.37508" /><g
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.82222px;font-family:'Liberation Mono';-inkscape-font-specification:'Liberation Mono, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
id="g4-7-0"
|
||||||
x="83.26268"
|
transform="translate(-11.145477,39.927363)"><rect
|
||||||
y="98.37561"
|
style="font-variation-settings:'wght' 700;fill:#e6e6e6;fill-opacity:1;stroke-width:2.47329;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
id="tspan2143" /></text>
|
id="rect1-3-7-5"
|
||||||
<text
|
width="330.55685"
|
||||||
xml:space="preserve"
|
height="57.886284"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.52778px;font-family:'Courier 10 Pitch';-inkscape-font-specification:'Courier 10 Pitch, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
x="917.30688"
|
||||||
x="65.910881"
|
y="126.45267" /><text
|
||||||
y="97.044113"
|
xml:space="preserve"
|
||||||
id="text4813-0"><tspan
|
style="font-style:normal;font-variant:normal;font-weight:600;font-stretch:normal;font-size:24px;font-family:Montserrat;-inkscape-font-specification:'Montserrat, Semi-Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;white-space:pre;inline-size:345.106;display:inline;fill:#3e4349;fill-opacity:1;stroke-width:3.5;stroke-linecap:round;stroke-linejoin:round;paint-order:markers fill stroke"
|
||||||
sodipodi:role="line"
|
x="954.24536"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.52778px;font-family:'Droid Sans';-inkscape-font-specification:'Droid Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
y="158.38867"
|
||||||
x="65.910881"
|
id="text1-6-6"
|
||||||
y="97.044113"
|
transform="matrix(0.85813569,0,0,0.85813569,117.98976,13.088921)"><tspan
|
||||||
id="tspan2143-9">Fingerprint:</tspan><tspan
|
x="954.24536"
|
||||||
sodipodi:role="line"
|
y="158.38867"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.82222px;font-family:'Liberation Mono';-inkscape-font-specification:'Liberation Mono, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
id="tspan1">Fingerprint of an OpenPGP </tspan><tspan
|
||||||
x="65.910881"
|
x="954.24536"
|
||||||
y="101.5379"
|
y="188.38867"
|
||||||
id="tspan2447">AAA1 8CBB 2546 85C5 8358 3205 63FD 37B6</tspan><tspan
|
id="tspan2">component key </tspan></text></g></g><g
|
||||||
sodipodi:role="line"
|
id="g41-8"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.82222px;font-family:'Liberation Mono';-inkscape-font-specification:'Liberation Mono, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
style="display:inline"
|
||||||
x="65.910881"
|
inkscape:label="Subkey encr"
|
||||||
y="105.94762"
|
transform="translate(144.65109,1015.3407)"><path
|
||||||
id="tspan1">7F33 00F9 FB0E C457 378C D29F 1026 98B3</tspan><tspan
|
id="rect11-2-2"
|
||||||
sodipodi:role="line"
|
d="m 884.2432,192.95468 h 359.0109 a 18.14255,18.14255 45 0 1 18.1425,18.14255 v 126.63435 a 18.14255,18.14255 135 0 1 -18.1425,18.14255 H 884.2432 A 18.14255,18.14255 45 0 1 866.10065,337.73158 V 211.09723 a 18.14255,18.14255 135 0 1 18.14255,-18.14255 z"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.82222px;font-family:'Liberation Mono';-inkscape-font-specification:'Liberation Mono, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-dasharray:none;stroke-opacity:1"
|
style="font-variation-settings:'wght' 500;fill:none;fill-opacity:0.1;stroke:#195962;stroke-width:4.39384;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
x="65.910881"
|
inkscape:path-effect="#path-effect35-9-9"
|
||||||
y="110.35734"
|
inkscape:original-d="M 866.10065,192.95468 H 1261.3966 V 355.87413 H 866.10065 Z"
|
||||||
id="tspan2449" /></text>
|
transform="matrix(0.94985532,0,0,0.73417064,31.221087,187.24009)" /><text
|
||||||
<rect
|
xml:space="preserve"
|
||||||
style="fill:none;stroke:#000000;stroke-width:0.206006;stroke-dasharray:none;stroke-opacity:0.3512"
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:22.2565px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.65147;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
id="rect6679-4"
|
x="879.95685"
|
||||||
width="34.837379"
|
y="407.40775"
|
||||||
height="26.931179"
|
id="text11-6-9"
|
||||||
x="81.494324"
|
transform="scale(0.98944428,1.0106683)"><tspan
|
||||||
y="65.851822" />
|
sodipodi:role="line"
|
||||||
<text
|
id="tspan11-94-9"
|
||||||
xml:space="preserve"
|
x="879.95685"
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.82223px;font-family:'Liberation Mono';-inkscape-font-specification:'Liberation Mono, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#ffffff;stroke:#000000;stroke-width:0.176389;stroke-opacity:0.3512"
|
y="407.40775"
|
||||||
x="66.635132"
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:22.2565px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start;stroke-width:3.65147">- key creation time</tspan></text><path
|
||||||
y="110.99274"
|
id="path2-1-6"
|
||||||
id="text2347"><tspan
|
style="display:inline;fill:none;stroke:#006961;stroke-width:10.4431;stroke-linecap:round;stroke-dasharray:none;stroke-opacity:1"
|
||||||
sodipodi:role="line"
|
d="m 156.30312,759.25868 c -9.78054,19.91382 -30.12868,33.02384 -53.81237,33.02384 -33.173715,0 -60.066326,-26.89261 -60.066326,-60.06633 0,-33.17372 26.892611,-60.06633 60.066326,-60.06633 23.31181,0 43.58824,15.15712 53.54415,34.5646 m -9.14624,1.20213 h 4.97796 c 10.89491,0.20296 25.86265,0 38.79397,0 l 11.43353,7.63836 14.59897,-7.63836 14.59896,7.3422 h 10.87817 l 11.54761,-7.3422 17.66083,7.3422 16.34856,-7.34219 22,25.45886 -22,25.45887 h -135.8606 -4.97796 M 89.058073,732.21619 c -4e-6,6.98969 -5.666271,12.65596 -12.655965,12.65596 -6.989695,0 -12.655963,-5.66627 -12.655967,-12.65596 -2e-6,-6.9897 5.666268,-12.65597 12.655967,-12.65597 6.989698,0 12.655967,5.66627 12.655965,12.65597 z"
|
||||||
id="tspan2345"
|
inkscape:label="Publickey ((Asym))"
|
||||||
style="stroke-width:0.176389"
|
sodipodi:nodetypes="cssscccccccccccccccsssss"
|
||||||
x="66.635132"
|
transform="matrix(0.32619502,0,0,-0.33319205,1106.4974,649.79131)"
|
||||||
y="110.99274" /></text>
|
inkscape:path-effect="#path-effect32-1-8"
|
||||||
</g>
|
inkscape:original-d="m 156.30312,759.25868 c -9.78054,19.91382 -30.12868,33.02384 -53.81237,33.02384 -33.173715,0 -60.066326,-26.89261 -60.066326,-60.06633 0,-33.17372 26.892611,-60.06633 60.066326,-60.06633 23.31181,0 43.58824,15.15712 53.54415,34.5646 m -9.14624,1.20213 h 4.97796 c 10.89491,0.20296 25.86265,0 38.79397,0 l 11.43353,7.63836 14.59897,-7.63836 14.59896,7.3422 h 10.87817 l 11.54761,-7.3422 17.66083,7.3422 16.34856,-7.34219 22,25.45886 -22,25.45887 h -135.8606 -4.97796 M 89.058073,732.21619 c -4e-6,6.98969 -5.666271,12.65596 -12.655965,12.65596 -6.989695,0 -12.655963,-5.66627 -12.655967,-12.65596 -2e-6,-6.9897 5.666268,-12.65597 12.655967,-12.65597 6.989698,0 12.655967,5.66627 12.655965,12.65597 z" /><text
|
||||||
</svg>
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:22.2565px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:3.65147;stroke-linecap:round;stroke-linejoin:round;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="880.12274"
|
||||||
|
y="357.29468"
|
||||||
|
id="text11-2-8-02"
|
||||||
|
transform="scale(0.98944428,1.0106683)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-7"
|
||||||
|
x="880.12274"
|
||||||
|
y="357.29468"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:22.2565px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start;stroke-width:3.65147">Component Key</tspan></text></g><g
|
||||||
|
id="g67"
|
||||||
|
transform="translate(142.42627,1018.1906)"
|
||||||
|
style="display:inline;stroke-width:1.7;stroke-dasharray:none"><rect
|
||||||
|
style="fill:#baa600;fill-opacity:0.25;stroke:#baa600;stroke-width:1.4;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:2.8, 2.8;stroke-dashoffset:0;stroke-opacity:1;paint-order:fill markers stroke"
|
||||||
|
id="rect66"
|
||||||
|
width="378.45499"
|
||||||
|
height="52.826336"
|
||||||
|
x="855.52289"
|
||||||
|
y="454.69138" /><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:21.3333px;line-height:17.9px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;white-space:pre;inline-size:393.624;display:inline;opacity:1;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:1.7786;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="562.8764"
|
||||||
|
y="408.97891"
|
||||||
|
id="text11-3-4-3"
|
||||||
|
transform="matrix(0.95580583,0,0,0.95580583,326.86618,86.500043)"
|
||||||
|
inkscape:label="fingerprint sk encr"><tspan
|
||||||
|
x="562.8764"
|
||||||
|
y="408.97891"
|
||||||
|
id="tspan4"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan3">C0A5 8384 A438 E5A1 4F73 7124 26A4 D45D</tspan> </tspan><tspan
|
||||||
|
x="562.8764"
|
||||||
|
y="428.39824"
|
||||||
|
id="tspan6"><tspan
|
||||||
|
style="font-size:16px;font-family:Monospace;-inkscape-font-specification:'Monospace, Normal'"
|
||||||
|
id="tspan5">BAEE F4A3 9E6B 30B0 9D55 13F9 78AC CA94</tspan></tspan></text><text
|
||||||
|
xml:space="preserve"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:18.6667px;font-family:Sans;-inkscape-font-specification:'Sans, @wght=500';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-variation-settings:'wght' 500;text-align:start;text-anchor:start;display:inline;fill:#3e4349;fill-opacity:1;stroke:none;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;paint-order:markers fill stroke"
|
||||||
|
x="740.55432"
|
||||||
|
y="476.66418"
|
||||||
|
id="text11-2-8-02-9"
|
||||||
|
transform="scale(0.98944431,1.0106683)"><tspan
|
||||||
|
sodipodi:role="line"
|
||||||
|
id="tspan11-9-0-7-1"
|
||||||
|
x="740.55432"
|
||||||
|
y="476.66418"
|
||||||
|
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:18.6667px;font-family:Montserrat;-inkscape-font-specification:'Montserrat Medium';text-align:start;text-anchor:start;stroke-width:1.7;stroke-dasharray:none">Fingerprint</tspan></text><path
|
||||||
|
style="opacity:1;fill:none;fill-opacity:1;stroke:#baa600;stroke-width:1.4;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:2.8, 2.8;stroke-dashoffset:0;stroke-opacity:1;marker-start:url(#Square);paint-order:fill markers stroke"
|
||||||
|
d="m 853.59098,505.62944 -78.85694,0.0298 -0.27607,-16.40163"
|
||||||
|
id="path252"
|
||||||
|
sodipodi:nodetypes="ccc" /></g></g></g></svg>
|
||||||
|
|
|
||||||
|
Before Width: | Height: | Size: 8.9 KiB After Width: | Height: | Size: 17 KiB |
Loading…
Reference in a new issue