Re: [dane] PGP security models, was Summary of IETF LC for draft-ietf-dane-openpgpkey

Paul Wouters <paul@nohats.ca> Tue, 22 September 2015 15:11 UTC

Date: Tue, 22 Sep 2015 11:11:11 -0400
From: Paul Wouters <paul@nohats.ca>
To: John C Klensin <john-ietf@jck.com>
In-Reply-To: <754374D2DB528FC99BE470A8@JcK-HP8200.jck.com>
Message-ID: <alpine.LFD.2.20.1509221108280.4663@bofh.nohats.ca>
References: <20150921172109.19893.qmail@ary.lan> <alpine.LFD.2.20.1509211455150.420@bofh.nohats.ca> <754374D2DB528FC99BE470A8@JcK-HP8200.jck.com>
User-Agent: Alpine 2.20 (LFD 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; format="flowed"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dane/9dQoiddNFNfgW8CGE8TS-E7eqbU>
Cc: ietf@ietf.org, dane WG list <dane@ietf.org>
Subject: Re: [dane] PGP security models, was Summary of IETF LC for draft-ietf-dane-openpgpkey
Precedence: list

On Tue, 22 Sep 2015, John C Klensin wrote:

> However, if you believe that, because of trust issues, people
> get keys only from personal contacts rather than indirectly from
> public databases, why are we discussing yet another public
> database-based approach?   Or are you convinced that the problem
> with the other public databases is that the DNS is inherently
> better for some reason such as the inability of third parties
> not associated with the domain in the address to add keys?

Yes.

The other common use problem is not being able to delete keys, so you end
up using a keyserver, get a (verified by WoT) key and then in response
you get a plaintext message saying "I forgot my passphrase so i cannot
delete/revoke my old key". With DNS, you can remove the key from DNS
without needing the private key or passphrase to it.

Paul

Re: [dane] Summary of IETF LC for draft-ietf-dane… Viktor Dukhovni
Re: [dane] PGP security models, was Summary of IE… John Levine
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… manning
Re: [dane] PGP security models, was Summary of IE… manning
Re: [dane] PGP security models, was Summary of IE… Scott Kitterman
Re: [dane] PGP security models, was Summary of IE… John C Klensin
Re: [dane] PGP security models, was Summary of IE… Joe Abley
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] provisioning assumptions, was PGP secu… John Levine
Re: [dane] provisioning assumptions, was PGP secu… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… Randy Bush
Re: [dane] PGP security models, was Summary of IE… Viktor Dukhovni
Re: [dane] PGP security models, was Summary of IE… Randy Bush
Re: [dane] PGP security models, was Summary of IE… Sam Hartman
Re: [dane] PGP security models, was Summary of IE… Dave Crocker
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… Sam Hartman
Re: [dane] PGP security models, was Summary of IE… Dave Crocker