Re: [keyassure] publishing the public key

[Henry Story <[e-mail]>]

On 14 Feb 2011, at 15:19, Paul Wouters wrote:

> On Mon, 14 Feb 2011, Henry Story wrote:
> 
>> In draft-dane-04 [1] one can currently only publish either a signature or a certificate in the DNS. That is the only allowed formats of the resource record are as specified in section 2.2
>> 
>> 1 -- Hash of an end-entity certificate
>> 2 -- Full end-entity certificate in DER encoding
>> 3 -- Hash of an certification authority's certificate
>> 4 -- Full certification authority's certificate in DER encoding
>> 
>> Why not publish the only piece of the certificate that is important in public key cryptography: the public key. ( This is what WebID does currently ) This should be shorter than the certificate, and though it will be longer than the signature, it will be a lot more useful, tying the publisher much less to a particular serialisation format. So you reduce the PGP/X509 disagreements.
> 
> Yes. This was asked by others including me as well. People thought it would be no
> problem to add this to dane once a bare public key TLS method exists.
> 
>>  An important question is of course: how much bandwidth does one save?
> 
> Bandwidth does not really matter. What matters is latency (less round trips) and a riddance of ASN.1
> parsing.
> 
> If you want to help writing a bare public key TLS variant, please contact me.

What do you mean by a bare public key TLS variant? You mean start an IETF group
to spec out how the client and the server should communicate in a TLS variant
that would not require the server to send a certificate? Or is this something that
one needs to do to explain how a User Agent can prove authenticity of the server from
a public key alone? (That's so simple it's a bit difficult to even see how to write it)
Or is it just that one needs to specify text for dane? Or is dane a subproject of 
keyassure, and this is referring to some other project here? Or is do
we just need to specify some text that is going to go into dane?

Sorry. I don't have a good picture of the web of specs that dane is tied into.

If its longer project I probably won't have time to do this myself as I am already 
quite tied up with WebID. But if I know what is needed we could write up a little 
note on the W3C WebID Incubator Group ( http://tinyurl.com/webidxg ) for our final 
report on what browser improvements would be helpful, and why. Hopefully this will 
be something that the browser vendors at the W3C could have a closer look at. But
it really depends on how long the project is. Perhaps there are people on our list who
have more time to participate. Perhaps this won't take so long to do...

	Henry


> 
> Paul

Social Web Architect
http://bblfish.net/