On Tue, Sep 24, 2002 at 06:08:17PM +0200, disastry(_at_)saiknes(_dot_)lv wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Bodo Moeller wrote:
Of course the one problem we cannot avoid is that the legitimate owner
of the key cannot keep the key alive indefinitely. This is because
this "problem" is exactly the security feature that me and Florian
Weimer and Derek Atkins want to have: we don't want the bad guy to be
able to unexpire the key if he gets hold of the secret key.
so set key expiration in direct key signature. there can be only
one direct key signature. direct key signature is self signature (5.2.3.3)
so key expiration can be set in it. (though most PGP implementations may
not recognize key expiration in direct key signature....)
It is not true that there can be only one direct key signature. In
fact, in certain cases you pretty much must have more than one. For
example, if you have multiple designated revokers which are all
sensitive.
David
--
David Shaw | dshaw(_at_)jabberwocky(_dot_)com | WWW
http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
"There are two major products that come out of Berkeley: LSD and UNIX.
We don't believe this to be a coincidence." - Jeremy S. Anderson