]> Mailpile ehf

Baronsstig Iceland bre@mailpile.is

Independent

juga@riseup.net

American Civil Liberties Union

125 Broad St. New York, NY 10004 USA dkg@fifthhorseman.net

int openpgp Internet-Draft The OpenPGP development community benefits from sharing samples of signed or encrypted data. This document facilitates such collaboration by defining a small set of OpenPGP certificates and keys for use when generating such samples. The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the OpenPGP Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction The OpenPGP development community, in particular the e-mail development community, benefits from sharing samples of signed and/or encrypted data. Often the exact key material used does not matter because the properties being tested pertain to implementation correctness, completeness or interoperability of the overall system. However, without access to the relevant secret key material, a sample is useless. This document defines a small set of OpenPGP certificates and secret keys for use when generating or operating on such samples. Samples are provided for four "personas", Alice, Bob, Carol, and David. Alice has two certificates currently active: a version 4 certificate, using legacy framing for the Ed25519 elliptic curve algorithm (for compatibility with legacy implementations), and a modern v6 certificate using standard mandatory-to-implement (MTI) algorithms from . Bob also uses a version 4 certificate, but he fears a potential quantum computer that might attack 256-bit ECC security, and has a 3072-bit RSA key which he thinks might force an adversary with a quantum computer to spend more resources attacking. Carol is a bit behind the times and has a DSA/ElGamal key, which is deprecated in . David is a minimalist, and uses version 6 certificate offering mainly MTI algorithms from .

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terminology This document makes use of terminology from . For subtle terminology changes from older versions of OpenPGP, see .

Alice's Certificates Alice has two certificates in operation at once, as she is trying to transition from her old certificate to a more up-to-date version.

Alice's Ed25519Legacy Version 4 Certificate Properties: OpenPGP Version: 4 Fingerprint: EB85 BB5F A33A 75E1 5E94 4E63 F231 550C 4F47 E38E Primary key algorithm: EdDSALegacy(Ed25519Legacy) () Primary key creation date: Tue Jan 22 11:56:25 GMT 2019 Primary key capabilities: certify, sign User ID: Alice Lovelace <alice@openpgp.example> Symmetric algorithm preferences for SEIPDv1: AES-256, AES-192, AES-128, 3DES Hash algorithm preferences: SHA512, SHA384, SHA256, SHA224, SHA1 Compresson algorithm preferences: ZLIB, BZip2, ZIP Subkey algorithm: ECDH (Curve25519Legacy) Subkey capabilities: encrypt Subkey creation date: Tue Jan 22 11:56:25 GMT 2019 There are no expiration dates in the entire certificate The secret key material is in the clear (no password) All OpenPGP signature packets contain a hashed Issuer Fingerprint subpacket (see )

Alice's Version 4 OpenPGP Certificate

Alice's Version 4 OpenPGP Secret Key Material

Alice's Version 4 Revocation Certificate

Alice's Version 6 Certificate Properties: OpenPGP Version: 6 Fingerprint: Primary key algorithm: Ed25519 () Primary key creation date: 2025-05-08 Primary key capabilities: certify, sign User ID: Alice Lovelace <alice@openpgp.example> Symmetric algorithm preferences for SEIPDv1: AES-256, AES-128 Ciphersuite preferences for SEIPDv2: AES-256+OCB, AES-128+OCB Hash algorithm preferences: SHA512, SHA256 Compresson algorithm preferences: Uncompressed, Zlib Subkey algorithm: X25519 () Subkey capabilities: encrypt Subkey creation date: 2025-05-08 There are no expiration dates in the entire certificate The secret key material is in the clear (no password) All OpenPGP signature packets contain a hashed Issuer Fingerprint subpacket (see )

Alice's Version 6 OpenPGP Certificate

Alice's Version 6 OpenPGP Secret Key Material

Alice's Version 6 Revocation Certificate

Bob's RSA-3072 Samples Properties: OpenPGP Version: 4 Fingerprint: D1A6 6E1A 23B1 82C9 980F 788C FBFC C82A 015E 7330 Primary key algorithm: RSA 3072 () Primary key creation date: Tue Oct 15 10:18:26 GMT 2019 Primary key capabilities: certify, sign User ID: Bob Babbage <bob@openpgp.example> Symmetric algorithm preferences for SEIPDv1: AES-256, AES-192, AES-128, 3DES Hash algorithm preferences: SHA512, SHA384, SHA256, SHA224, SHA1 Compresson algorithm preferences: ZLIB, BZip2, ZIP Subkey algorithm: RSA 3072 Subkey capabilities: encrypt Subkey creation date: Tue Oct 15 10:18:26 GMT 2019 There are no expiration dates in the entire certificate The secret key material is in the clear (no password) All OpenPGP signature packets contain a hashed Issuer Fingerprint subpacket (see )

Bob's OpenPGP Certificate

Bob's OpenPGP Secret Key Material

Bob's Revocation Certificate

Carol's DSA/ElGamal Samples Properties: OpenPGP Version: 4 Fingerprint: 71FF DA00 4409 E5DD B0C3 E8F1 9BA7 89DC 76D6 849A Primary key algorithm: DSA 3072/256 () Primary key creation date: Sat Dec 21 2019 Primary key capabilities: certify, sign User ID: Carol Oldstyle <carol@openpgp.example> Symmetric algorithm preferences for SEIPDv1: AES-256, AES-192, AES-128 Hash algorithm preferences: SHA512, SHA384, SHA256 Compresson algorithm preferences: ZIP Subkey algorithm: ElGamal 3072/256 Subkey capabilities: encrypt Subkey creation date: Sat Dec 21 2019 There are no expiration dates in the entire certificate The secret key material is in the clear (no password) All OpenPGP signature packets contain a hashed Issuer Fingerprint subpacket (see )

Carol's OpenPGP Certificate

Carol's OpenPGP Secret Key Material

Carol's Revocation Certificate

David's v6 Ed25519/X25519 Sample David Deluxe's OpenPGP material is a minimalist example focusing on the mandatory-to-implement (MTI) aspects of . Properties: OpenPGP Version: 6 Fingerprint: 4199D9EAA6682A78D5A534F62BF76222A54E4DEBC785DBE6A6C5B34586026FE2 Primary key algorithm: Ed25519 () Primary key creation date: 2025-04-16 Primary key capabilities: certify, sign User ID: David Deluxe <david@openpgp.example> Symmetric algorithm preferences for SEIPDv1: AES-256, AES-128 Ciphersuite preferences for SEIPDv2: AES-256+OCB, AES-128+OCB Hash algorithm preferences: SHA512, SHA256 Compresson algorithm preferences: Uncompressed, Zlib Subkey algorithm: X25519 () Subkey capabilities: encrypt Subkey creation date: 2025-04-16 There are no expiration dates in the entire certificate The secret key material is in the clear (no password) All OpenPGP signature packets contain a hashed Issuer Fingerprint subpacket (see )

David's OpenPGP Certificate

David's OpenPGP Secret Key Material

David's Revocation Certificate

Security Considerations The keys presented in this document should be considered compromised and insecure, because the secret key material is published and therefore not secret. Applications which maintain blacklists of invalid key material SHOULD include these keys in their lists.

IANA Considerations IANA has nothing to do for this document.

Document Considerations [ RFC Editor: please remove this section before publication ]

Document History Changes between -02 and -03: - added new v6 certificate for Alice in addition to the existing v4 cert (representing someone with both a compatibility-focused certificate and a modern certificate) Changes between -01 and -02: - added Carol (DSA/Elgamal example) - added David (v6 MTI example) Changes between -00 and -01: converted to XML2RFC v3 added internal backreferences to sample material to spread awareness

Acknowledgements The authors would like to acknowledge the help and input of the other participants at the . Heiko Stamer contributed Carol's OpenPGP material.

In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document specifies the message formats used in OpenPGP. OpenPGP provides encryption with public key or symmetric cryptographic algorithms, digital signatures, compression, and key management. This document is maintained in order to publish all necessary information needed to develop interoperable applications based on the OpenPGP format. It is not a step-by-step cookbook for writing an application. It describes only the format and methods needed to read, check, generate, and write conforming packets crossing any network. It does not deal with storage and implementation questions. It does, however, discuss implementation issues necessary to avoid security flaws. This document obsoletes RFCs 4880 ("OpenPGP Message Format"), 5581 ("The Camellia Cipher in OpenPGP"), and 6637 ("Elliptic Curve Cryptography (ECC) in OpenPGP").