Re: [keyassure] publishing the public key

[Martin Rex <[e-mail]>]

Paul Wouters wrote:
> 
> On Mon, 14 Feb 2011, Henry Story wrote:
> >
> > Why not publish the only piece of the certificate that is important
> > in public key cryptography: the public key.
>
> Yes. This was asked by others including me as well. People thought it would
> be no problem to add this to dane once a bare public key TLS method exists.
> 
> >   An important question is of course: how much bandwidth does one save?
> 
> Bandwidth does not really matter. What matters is latency
> (less round trips) and a riddance of ASN.1 parsing.

The current approach of admins to run a TLS server with a bare public
key is to generate themselves a self-signed (X.509v1) Certificate.
That is probably what many folks are doing when protecting Web access to
their HomeNAS, Home DSL-router, Home DVB-s receiver, etc.

This works with the installed base, in particular with the installed
base of servers.  Though it doesn't work that well with Web Browsers
as clients.  In particular, many recent browers are pretty badly broken
when it comes to a sensible UI for servers using a self-signed cert.

-Martin