Re: [Dcrup] Hashed Key Records

I would really like to get to a point where we could use one fingerprint
format everywhere. This would then allow fingerprints to be cut and pasted
from one place to another.

When I suggest we do something of this sort, people say 'write a draft'.
Once I write a draft they say I am peddling my proposal. So pretend that I
don't have a draft yet. These are the features I think are needed:

1) Use Base32 encoding.

DNS labels are case insensitive. Using fingerprints in DNS labels is very
powerful. It allows DANE like effects without the need for DANE records or
DNSSEC.

2) Incorporate the algorithm identifier into the fingerprint, do so in a
way that ensures a Base32 fingerprint will never be confused with a PGP
fingerprint.

3) Include a description of the content type in the target of the
fingerprint. This prevents semantic substitution attacks.

4) Allow for optional grouping of characters to encourage readability.

On Thu, Jun 22, 2017 at 7:17 PM, Scott Kitterman <sklist@kitterman.com>
wrote:

> It seemed like the hashed RSA variant ought to be easy enough to
> implement, so
> I decided to give it a go.  I almost immediately ran into a question.  For
> terminology, I'm using what openssl says [1]
>
> I am assuming that "SHA-256 hash of the public key, stored in base64" means
> use the output of the digest in binary form (--binary) option and encode
> it in
> base 64.  Is that correct?
>
>
> So if my signing key were (I know, but just to make sure I understand the
> tranformations):
>
> 'Hello World'
>
> Then the the p tag in DNS would be:
>
> p=pZGm1Av0IEBKARczz7exkNYsZb8LzaMrV7J32a2fFG4=
>
> Am I understanding it correctly?
>
> A python one liner:
>
> >>> base64.b64encode(hashlib.sha256(b'Hello World').digest())
> 'pZGm1Av0IEBKARczz7exkNYsZb8LzaMrV7J32a2fFG4='
>
> Scott K
>
>
>
> [1] https://www.openssl.org/docs/man1.1.0/apps/sha256.html
>
> _______________________________________________
> Dcrup mailing list
> Dcrup@ietf.org
> https://www.ietf.org/mailman/listinfo/dcrup
>