Re: Providing keys through Web Key Directory protocol
Wiktor Kwapisiewicz <[email protected]> Wed, 17 Oct 2018 10:30:47 +0200
| Newsgroups | gmane.comp.horde.devel |
|---|---|
| Organization | Metacode |
| Message-ID | <[email protected]> |
On 16.10.2018 15:03, Ralf Lang wrote: > > Zitat von Wiktor Kwapisiewicz <[email protected]>: > >> Hello Horde Dev, >> >> I would like to add support for providing user's PGP keys in Horde >> through Web Key Directory protocol. >> >> Relevant ticket: https://bugs.horde.org/ticket/14465 >> >> A quick explanation what WKD does: modern GnuPG allows looking up PGP >> keys by e-mail addresses by converting e-mails to HTTPS URLs that are >> used to fetch the key (more info at https://wiki.gnupg.org/WKD ). >> >> For example, using "gpg --locate-key [email protected]" fetches the >> key from >> https://kernel.org/.well-known/openpgpkey/hu/pf113mfnx1f3eb1yiwhsipa91xfc7o4x >> >> >> (the local part is SHA1-ed and encoded using ZBase32) >> >> Horde could store the encoded username hash in database, have an >> endpoint that would catch "/.well-known/openpgpkey/hu" calls, retrieve >> user's pgpPublicKey and return the binary key (or 404 if the key doesn't >> exist). >> >> I think storing additional attribute - encoded localpart is needed >> because it's not possible to easily reverse the hash to username. I've >> checked the Pgp component and it seems Horde_Pgp_Element_PublicKeys have >> to_bytes() method that can be used to return binary encoded OpenPGP key. >> >> Could you check if this reasoning is sound? I would appreciate any tips >> in development of this feature as the sheer size of the code base is a >> little bit intimidating :) >> >> Currently I've got a small problem with horde-git-tools (in attachment) >> but I'll try some alternative methods to get the source. >> >> Thank you for your time! >> >> Kind regards, >> Wiktor > > Hi Wiktor, > > sounds basically reasonable. We just need to ensure not to tie it to the > user but to the identity - a user can have multiple identities, user > names etc. Yes, WKD's input is domain (example.com) and hash (zbase32), and the hash directly corresponds to local-part of the e-mail address (it's just SHA1-hashed). So it would be good to put the hash in the same place where an e-mail address is stored (this probably means "identity") and on lookup retrieve user associated with that pair and their PGP key. Thanks for your input! Kind regards, Wiktor -- https://metacode.biz/@wiktor -- dev mailing list Frequently Asked Questions: http://wiki.horde.org/FAQ To unsubscribe, mail: [email protected]