Re: [dane] PGP security models, was Summary of IETF LC for draft-ietf-dane-openpgpkey

Paul Wouters <paul@nohats.ca> Wed, 23 September 2015 16:01 UTC

Date: Wed, 23 Sep 2015 12:01:16 -0400
From: Paul Wouters <paul@nohats.ca>
To: Randy Bush <randy@psg.com>
In-Reply-To: <m21tdpy2oa.wl%randy@psg.com>
Message-ID: <alpine.LFD.2.20.1509231159210.5645@bofh.nohats.ca>
References: <20150921172109.19893.qmail@ary.lan> <alpine.LFD.2.20.1509211455150.420@bofh.nohats.ca> <m2pp19ztmu.wl%randy@psg.com> <20150923035731.GZ21942@mournblade.imrryr.org> <m21tdpy2oa.wl%randy@psg.com>
User-Agent: Alpine 2.20 (LFD 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; format="flowed"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dane/X9oBtoVGdkildzeAc7YP8EbxgZY>
Cc: ietf@ietf.org, dane WG list <dane@ietf.org>
Subject: Re: [dane] PGP security models, was Summary of IETF LC for draft-ietf-dane-openpgpkey
Precedence: list

On Wed, 23 Sep 2015, Randy Bush wrote:

> if i think of it as a form of opportunistic encryption with very weak
> authentication it seems useful.

right.

> but when i want strong authentication i want strong introduction.

So pull the key from DNSSEC, check for sigs. If not good enough, you
could also pull the same key from the keyservers (now that you know
that's the key you are looking for in the pile of garbage keys on the
keyservers) and possibly get more signatures on it. Still not good
enough, don't send the email and find some humans.

Paul

Re: [dane] Summary of IETF LC for draft-ietf-dane… Viktor Dukhovni
Re: [dane] PGP security models, was Summary of IE… John Levine
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… manning
Re: [dane] PGP security models, was Summary of IE… manning
Re: [dane] PGP security models, was Summary of IE… Scott Kitterman
Re: [dane] PGP security models, was Summary of IE… John C Klensin
Re: [dane] PGP security models, was Summary of IE… Joe Abley
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] provisioning assumptions, was PGP secu… John Levine
Re: [dane] provisioning assumptions, was PGP secu… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… Randy Bush
Re: [dane] PGP security models, was Summary of IE… Viktor Dukhovni
Re: [dane] PGP security models, was Summary of IE… Randy Bush
Re: [dane] PGP security models, was Summary of IE… Sam Hartman
Re: [dane] PGP security models, was Summary of IE… Dave Crocker
Re: [dane] PGP security models, was Summary of IE… Paul Wouters
Re: [dane] PGP security models, was Summary of IE… Sam Hartman
Re: [dane] PGP security models, was Summary of IE… Dave Crocker