Re: [keyassure] publishing the public key

[Paul Hoffman <[e-mail]>]

On 2/19/11 9:09 AM, Phillip Hallam-Baker wrote:
> The problem with this approach is that it means that we are going to at
> best be exercising new code paths in existing code. At worst we are
> going to force people to write new code.

Fully agree on both. I have yet to see what I asked for early on, which 
is any text that explains how a TLS client who gets a bare key would use 
it in TLS.

If there is later a standards-track extension to TLS that handles bare 
public keys, that format can be added to TLSA at that time. It would use 
the exact same format so that clients can do exact matching without 
having to process either the key data from TLSA/DNS or the key data from 
the TLS handshake.

I'm still open to hearing *why* adding bare keys would help TLSA, but I 
would also want to see text about how the processing would go so that I 
could weigh the benefit against the cost.