Re: [keyassure] publishing the public key

On 15 Feb 2011, at 03:49, Paul Wouters wrote:

> On Tue, 15 Feb 2011, Peter Gutmann wrote:

( Btw, I could not find the thread of this discussion in context, and this
may be reflected in my reply. It would help to point to the web archive 
if it's an older post that is being replied to here. )

> 
>> A public key contains a number of components and options. For example for ECC
>> there are the basic key values p, a, b, G, n, h (or m, f, a, b, G, n, h for
>> binary curves), an indication of the underlying field (prime or binary), the
>> point format, whether point compression is used, polynomial vs. normal basis,
>> whether fixed domain parameters are used, and probably some other stuff I've
>> forgotten.  How is all this stuff communicated?
> 
> I see.

At the simplest, can one not just take the  public key part of the ASN.1 that comes in an X.509 certificate, and pop that DER encoded in the yet to be named value field? 

Pro: it clearly is defined
Con: there is a bit of remaining ASN.1, but it's a lot less than before :-)

At least that shows that there is one easy solution. 

> 
>> this (a) ain't gonna cut it because it doesn't cover what's required by TLS
>> and (b) requires that your TLS implementation speak DNSSEC (or at least the
>> DNSKEY part of DNSSEC) just to get a key. I can't see TLS implementors being
>> too enthusiastic about this.
> 
> Okay.

Assuming this discussion is about publishing a public key in DNSSEC - let's not
care about the format - I would reply the following

(a) not sure why this answer was made
(b) Using the public key published in DNSSEC does not require that the TLS 
implementation speak DNSSEC. Current browsers that deal with millions of self
signed certificates on the internet will show ugly dialogs as they do now.
But future browser that are DNSSEC aware could use keyassure to give a better
dialog. They might not get EV certificate dialog, but at least they will know that
they have connected to the correct service.

They can do (b) whether the certificate is published in DNSSEC or whether the
public key is published there. It does not matter. After all the certificate contains
the public key, plus extra information.

Henry

> 
> I'll have to do some more reading to ensure I understand everything, and I'll
> write up something for this for you to check.
> 
> Thanks!
> 
> Paul
> _______________________________________________
> keyassure mailing list
> keyassure@ietf.org
> https://www.ietf.org/mailman/listinfo/keyassure

Social Web Architect
http://bblfish.net/