On 02/18/2011 12:56 AM, Ian G wrote:
* typically, people have expected things like digital signatures
masquerading as human signatures to survive a long time.
* some standards require 30 years of technology lifetime.
Actually, these two can be addressed while still doing away with V3 key
format. Since V3 signatures can be generated by V4 keys and the keyID in
V3 signatures is not part of the hashed material, one can re-package the
V3 key in V4 format and change the keyID part in the signature, while
still keeping the whole thing valid, without access to the private key.
The only thing missing would be the self-signature of the key, but that
is a minor compromise in the face of things like keyserver poisoning.
IMHO, of course.
--
Daniel A. Nagy
ePoint Systems Ltd.
signature.asc
Description: OpenPGP digital signature