3 ms·

If you want to encrypt something with my public key. You would run the following command (email address obfuscated): gpg --auto-key-locate pka -ear mike(dot)ca

If you want to encrypt something with my public key. You would run the following command (email address obfuscated): gpg --auto-key-locate pka -ear mike(dot)cardwell(at)grepular(dot)com gpg then automatically looks up the TXT record for "mike.cardwell._pka.grepular.com" in the DNS. Which gives it: "v=pka1\;fpr=35BCAF1D3AA21F843DC3B0CF70A5F5120018461F\;uri=http://grepular.com/0018461F.pub.asc http://grepular.com/0018461F.pub.asc It then automatically fetches my public key from the URL in that record, checks it matches the fingperint, and then imports it. For extra goodness, the DNS for "grepular.com" is secured with DNSSEC also. The technology exists for sharing public keys and using PGP. The major mail providers couldn't care less about providing user interfaces for it though.

betterunix 14y ago
Yeah but you still had to generate and publish that key before I could send you an encrypted message. If I need to communicate with someone who has not done so, what I am supposed to do? Nag at them to do it? Try to explain the important of encryption? I have tried it, and I still try, and it is basically not going to work: people generally do not see the point, and they hate the fact that they cannot check their mail from arbitrary systems (smartcards help here, but now you need to get reliable smartcard readers deployed all over the place). We need a system that lets people encrypt messages without having to wait for the receiver to do anything. That's the point of IBE: your public key is your email address, you get your private key from the service of the sender's choice. The service clearly needs to do something to verify your identity, which is the weakness -- but it is still better than what we do now, and it does not require us to wait for everyone to upgrade their email clients.
- mike-cardwell 14y ago
  Yeah, what you say is true. That would be better than what we have now. Re your comments about smart card readers. You can have smartcard functionality on any machine with a USB port if you use one of these: https://www.crypto-stick.com/ https://www.crypto-stick.com/ I received one a couple of weeks ago and it works great. I also have an OpenPGP v2 smart card, a USB smart card reader, and a reader built into my Thinkpad.

betterunix 14y ago

Yeah but you still had to generate and publish that key before I could send you an encrypted message. If I need to communicate with someone who has not done so, what I am supposed to do? Nag at them to do it? Try to explain the important of encryption? I have tried it, and I still try, and it is basically not going to work: people generally do not see the point, and they hate the fact that they cannot check their mail from arbitrary systems (smartcards help here, but now you need to get reliable smartcard readers deployed all over the place). We need a system that lets people encrypt messages without having to wait for the receiver to do anything. That's the point of IBE: your public key is your email address, you get your private key from the service of the sender's choice. The service clearly needs to do something to verify your identity, which is the weakness -- but it is still better than what we do now, and it does not require us to wait for everyone to upgrade their email clients.

mike-cardwell 14y ago
Yeah, what you say is true. That would be better than what we have now. Re your comments about smart card readers. You can have smartcard functionality on any machine with a USB port if you use one of these: https://www.crypto-stick.com/ https://www.crypto-stick.com/ I received one a couple of weeks ago and it works great. I also have an OpenPGP v2 smart card, a USB smart card reader, and a reader built into my Thinkpad.