[openpgp] Re: Using DNS Handles with OpenPGP

Andrew Gallagher <[email protected]> Wed, 12 Feb 2025 11:52:39 +0000

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

Hi, Phillip.

On 7 Feb 2025, at 21:29, Phillip Hallam-Baker <[email protected]> wrote:
> 
> So putting OpenPGP keys into the DNS directly seems like a bad idea. Better to use signed contacts and put the root of trust for the contact manager into the DNS:
> 
> _mesh.phill.hallambaker.com <http://mesh.phill.hallambaker.com/>. IN TXT "dsa=mbqn-a3es-zbye-xp3o-w6et-pqug-go5v@@example.com <http://example.com/>"
> 
> So what this does is bind my DNS handle to my Mesh direct service address which is a root-o-trust/service address pair. And then people can do a fetch to get my public contact assertion signed under that root o' trust and verify it. If my zone is DNSSEC signed, we have a fairly solid trust path for establishing TOFU.
> 
> And that contact assertion would hold my SSH credentials OpenPGP credentials, etc. etc. Right now I am just transferring the IANA protocol names into my JSON serialization.

This proposal sounds to me like it can already be done by combining WKD and Keyoxide [1] - WKD binds the key to the domain, and Keyoxide binds the various other identities to the key. Or am I missing an extra subtlety?

A

[1] www.keyoxide.org

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 833 B)