From fd2469e0e4762b4d969077edac1b61258a0aa4a1 Mon Sep 17 00:00:00 2001 From: Heiko Schaefer Date: Mon, 9 Oct 2023 18:57:56 +0200 Subject: [PATCH] ch4: make links for "more on this below" pointers --- book/source/04-certificates.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/book/source/04-certificates.md b/book/source/04-certificates.md index 8d2ae8c..e80769b 100644 --- a/book/source/04-certificates.md +++ b/book/source/04-certificates.md @@ -93,7 +93,7 @@ In the RFC, the OpenPGP primary key is also sometimes referred to as "top-level In addition to the primary key, modern OpenPGP certificates usually contain a number of "subkeys" (however, it's not technically necessary for a certificate to contain subkeys). -Subkeys have the same structure as the primary key, but they are used in a different role. Subkeys are cryptographically linked with the primary key (more on this below). +Subkeys have the same structure as the primary key, but they are used in a different role. Subkeys are cryptographically linked with the primary key (more on this in {numref}`binding_subkeys`). ```{figure} diag/Subkeys.png :name: Certificate with Subkeys @@ -140,8 +140,14 @@ OpenPGP certificates can contain any number of User IDs One User ID in a certificate has the special property of being the [Primary User ID](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-primary-user-id). -User IDs are associated with preference settings (such as preferred encryption algorithms, more on this below). The preferences associated with the Primary User ID are used by default. +User IDs are associated with preference settings (such as preferred encryption algorithms, more on this in {numref}`zooming_in_user_id`). The preferences associated with the Primary User ID are used by default. +```{admonition} TODO +:class: warning + +i think crypto-refresh suggests that the direct key signature should hold the default preferences? +we might need to write a more nuanced text here, about how DKS and primary user id interact in v6, and mention the differences to v4? +``` #### User attributes @@ -172,6 +178,7 @@ Note, though, that there are some cases where third parties legitimately add "un [^flooding]: Storing third-party identity certifications in the target OpenPGP certificate is convenient for consumers: it is easy to find all relevant certifications in one central location. However, when third parties can unilaterally add certifications, this opens an avenue for denial-of-service attacks by flooding. The SKS network of OpenPGP key servers [allowed and experienced this problem](https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html). +(binding_subkeys)= #### Binding subkeys to an OpenPGP certificate Linking a subkey to an OpenPGP certificate is done with a ["Subkey Binding Signature"](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#sigtype-subkey-binding). Such a signature signals that the "primary key wants to be associated with the subkey". @@ -852,6 +859,7 @@ Signature Packet, new CTB, 3 header bytes + 325 bytes 00000140 a6 73 c8 33 5a 9c d9 0a ``` +(zooming_in_user_id)= ### User ID User IDs are a mechanism for attaching *identities* to an OpenPGP certificate. Traditionally, User IDs contain a string that combines a name and an email address.