[openpgp] Re: [Dance] Key digest companion for RFC 7929 OPENPGPKEY

On Fri, 21 Nov 2025, Petr Menšík wrote:

[ removed dance@ from the thread ]

> Oh, okay. What I had on mind is to display key id. I think that is always 
> SHA256 now.

I clearly misunderstood your idea. I thought you wanted to publish
hashes of keys only to reduce pulling in full keys via DNS?

> My primary motivation was to provide easy check whether that user has changed 
> his key.

If they migrated keys from one to another, presumbly you have to fetch
the new key. So the only optimization is when they key is unchanged and
you want to see if it is still the current key. I guess what you could
do is provide a hash-of-key CNAME to the actual OPENPGPKEY record?
Although querying CNAMEs through proxies might still cause all the work,
so perhaps just a TXT record where you don't care about RRdata could be
used. I am not sure this effort is worth it though. You are installing
a few GB of new RPMs - I don't think a single large DNS query is making
much of a difference here?

>>  Such a prefix seems odd. It makes querying harder if there is a key
>>  update. Using the OPENPGPKEY method based on unique email address seems
>>  more robust to me.

> Uhm, this owner name is created by your own tool openpgpkey from 
> python3-hash-slinger package. This is exactly the same from RFC 7929, where 
> you are the author.

I misunderstood your original proposal and did not recognise the
hash-of-email :)

Paul

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]