Re: [keyassure] publishing the public key

[Henry Story <[e-mail]>]

On 14 Feb 2011, at 18:33, Martin Rex wrote:

> Paul Wouters wrote:
>> 
>> On Mon, 14 Feb 2011, Henry Story wrote:
>>> 
>>> Why not publish the only piece of the certificate that is important
>>> in public key cryptography: the public key.
>> 
>> Yes. This was asked by others including me as well. People thought it would
>> be no problem to add this to dane once a bare public key TLS method exists.
>> 
>>>  An important question is of course: how much bandwidth does one save?
>> 
>> Bandwidth does not really matter. What matters is latency
>> (less round trips) and a riddance of ASN.1 parsing.
> 
> The current approach of admins to run a TLS server with a bare public
> key is to generate themselves a self-signed (X.509v1) Certificate.
> That is probably what many folks are doing when protecting Web access to
> their HomeNAS, Home DSL-router, Home DVB-s receiver, etc.
> 
> This works with the installed base, in particular with the installed
> base of servers.  Though it doesn't work that well with Web Browsers
> as clients.  In particular, many recent browers are pretty badly broken
> when it comes to a sensible UI for servers using a self-signed cert.

Indeed, and this is why keyassure is going to be so useful for those people. 
They must just be itching to pop their public keys in DNSSEC as soon as the 
first browser vendors implement it. So you are guaranteed a large community
to spread the word and give you feedback. And I think Browser Vendors will be
very keen to implement this, as well as DNSSEC of course, given the terrible state
of DNS.

From WebID's perspective we love keyassure, because it will make deployment of https 
so much easier, and so make it much easier to create the Secure Decentralised 
Social Web which we want to build.  In fact we have an issue open there to follow 
your work here

 http://www.w3.org/2005/Incubator/webid/track/issues/5

It also permits "Turning every Web Server into a CA"
http://lists.w3.org/Archives/Public/public-xg-webid/2011Feb/0060.html

which is pretty cool I think.

 So all of the above will work as keyassure is written out now, but I do 
think that if one can reduce the bandwidth used by DNSSEC as much as possible
as well as get the best value for the bits used - which I think the public key
does - all the better. That will reduce the talk of DNS as a Denial of Serice 
Attack amplifier.

	Henry

> 
> -Martin

Social Web Architect
http://bblfish.net/