4 ms·
Makes sense if they don't plan it to become more accommodating and complex over time.
by xvilka 5y ago
Makes sense if they don't plan it to become more accommodating and complex over time.
- tptacek 5y agoIronically, by using a modern, stripped down signing system like this, they've probably increased their opportunities to do interesting things down the road, since they don't have all the possible weird interactions with the PGP system to consider.
- julian-klode 5y agoStill have to trust 1k RSA keys because GPG does not allow us to say they're unsafe.
- deknos 5y agoi am pretty sure you can mark them yourself. but that they are generally still used, well that's called backwards compatibility. and that's needed.
- upofadown 5y agoYou can tell how long a key is just by looking at it. You can then say anything you want. The use of particular keys is a Debian policy issue. It has nothing to do with the use of a particular message format like OpenPGP.
- julian-klode 5y agoThat's not how it works, no. This is a gpg specific issue as it does not communicate the key size over the status fd. We don't parse the keys ourselves for obvious reasons.
- upofadown 5y agoDunno about that but --with-colons certainly works to show the key length of a key.