3 ms·

We'll probably do this soon, HKP is older and more broadly supported at the moment so it got built first.

Boulth 8y ago
Got it, thanks for the reply and for considering modern features!
dane-pgp 8y ago
That makes sense, thanks. I'd love to see support for RFC-7929 at some point too. https://tools.ietf.org/html/rfc7929 https://tools.ietf.org/html/rfc7929 It has the advantage of not relying on the Certificate Authority system, and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to). DNSSEC also allows Authenticated Denial of Existence, so that unavailability of a server isn't treated as meaning the user doesn't have a key in the directory. For reference, this technology is also already supported by GnuPG and Posteo.de: https://posteo.de/en/blog/new-posteo-public-key-directory https://posteo.de/en/blog/new-posteo-public-key-directory
- Promarged 8y ago
  > It has the advantage of not relying on the Certificate Authority system I wouldn't say it's an advantage, while CA system has many flaws at least it's monitored somehow (for example via Certificate Transparency) while putting keys in DNS would require the app to validate records (does GnuPG do that?), not to mention the queries are not encrypted (so are visible to any hop) and could be transparently replaced by your government or TLD operator. Many DNS providers do not allow adding "exotic" records. For further info see e.g.: https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-control-the-internet/ https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con... > and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to). Email clients and servers that do PGP usually have "full web stack" already to connect to keyservers. Additionally while DANE or PKA lookups can be enabled in GnuPG only WKD is enabled by default ("auto-key-locate" is "local,wkd"). Nice nick by the way :)

Got it, thanks for the reply and for considering modern features!

That makes sense, thanks. I'd love to see support for RFC-7929 at some point too. https://tools.ietf.org/html/rfc7929 https://tools.ietf.org/html/rfc7929 It has the advantage of not relying on the Certificate Authority system, and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to). DNSSEC also allows Authenticated Denial of Existence, so that unavailability of a server isn't treated as meaning the user doesn't have a key in the directory. For reference, this technology is also already supported by GnuPG and Posteo.de: https://posteo.de/en/blog/new-posteo-public-key-directory https://posteo.de/en/blog/new-posteo-public-key-directory

Promarged 8y ago
> It has the advantage of not relying on the Certificate Authority system I wouldn't say it's an advantage, while CA system has many flaws at least it's monitored somehow (for example via Certificate Transparency) while putting keys in DNS would require the app to validate records (does GnuPG do that?), not to mention the queries are not encrypted (so are visible to any hop) and could be transparently replaced by your government or TLD operator. Many DNS providers do not allow adding "exotic" records. For further info see e.g.: https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-control-the-internet/ https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con... > and not requiring a full web stack (which some email clients and servers wouldn't want to open themselves up to). Email clients and servers that do PGP usually have "full web stack" already to connect to keyservers. Additionally while DANE or PKA lookups can be enabled in GnuPG only WKD is enabled by default ("auto-key-locate" is "local,wkd"). Nice nick by the way :)