Re: [dane] PGP security models, was Summary of IETF LC for draft-ietf-dane-openpgpkey

"John Levine" <johnl@taugh.com> Mon, 21 September 2015 17:21 UTC

Date: Mon, 21 Sep 2015 17:21:09 -0000
Message-ID: <20150921172109.19893.qmail@ary.lan>
From: John Levine <johnl@taugh.com>
To: ietf@ietf.org
In-Reply-To: <931830E6-6B8C-410E-9B57-F3E5CB5AE5B8@dukhovni.org>
Organization:
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/dane/R2i3JfGrosyt4fK_JSukDUsdZDU>
Cc: ietf@ietf.org, dane@ietf.org
Subject: Re: [dane] PGP security models, was Summary of IETF LC for draft-ietf-dane-openpgpkey
Precedence: list

>OPENPGP is a data format, WoT is one way to employ that format to
>exchange messages.   It is not a *required* way to use OPENPGP.

Sure, but it's the way that everyone has used PGP for 20 years,
and it's the security model that everyone I know expects when they
use PGP keys.

This draft uses a model in which the key is bound to a mailbox, not
any stronger identity, and you have to trust that the domain's
management fairly represents its users rather than e.g., publishing
MITM keys that it controls.  That's not a ridiculous model, but if
that's the model, the draft and draft-ietf-dane-openpgpkey-usage need
to say so.  At this point, neither does.

R's,
John

Re: [dane] Summary of IETF LC for draft-ietf-dane… Viktor Dukhovni
Re: [dane] PGP security models, was Summary of IE… John Levine
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… manning
Re: [dane] PGP security models, was Summary of IE… manning
Re: [dane] PGP security models, was Summary of IE… Scott Kitterman
Re: [dane] PGP security models, was Summary of IE… John C Klensin
Re: [dane] PGP security models, was Summary of IE… Joe Abley
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] provisioning assumptions, was PGP secu… John Levine
Re: [dane] provisioning assumptions, was PGP secu… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… Randy Bush
Re: [dane] PGP security models, was Summary of IE… Viktor Dukhovni
Re: [dane] PGP security models, was Summary of IE… Randy Bush
Re: [dane] PGP security models, was Summary of IE… Sam Hartman
Re: [dane] PGP security models, was Summary of IE… Dave Crocker
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… Sam Hartman
Re: [dane] PGP security models, was Summary of IE… Dave Crocker