Re: [keyassure] publishing the public key

[Paul Wouters <[e-mail]>]

On Tue, 15 Feb 2011, Peter Gutmann wrote:

>> If you want to help writing a bare public key TLS variant, please contact me.
>
> There is no such thing as a "bare public key".  Public keys have complex
> composite structures, and to encode that you need something like ASN.1 (unless
> you want to invent your own format, which is going to make things even
> uglier).  At this point you're duplicating a significant chunk of ASN.1-
> parsing code outside the certificate code that would normally handle it.  This
> does not seem like a good direction to go in.

The public key's type and raw blob will be obtained from DNSSEC, so
this is no longer required to be conveyed to the client from the server
via a PKIX certificate or other ASN.1 structures. No other certificate
information is desired.

Perhaps some other mode is required if the client needs to be
authenticated by the server, but the use we are talking about here is
for unauthenticated clients, eg the currently deployed "https" mode
without user certs/credentials.

Paul