Re: [keyassure] publishing the public key

[Paul Wouters <[e-mail]>]

On Mon, 14 Feb 2011, Henry Story wrote:

>  In draft-dane-04 [1] one can currently only publish either a signature or a certificate in the DNS. That is the only allowed formats of the resource record are as specified in section 2.2
>
>  1 -- Hash of an end-entity certificate
>  2 -- Full end-entity certificate in DER encoding
>  3 -- Hash of an certification authority's certificate
>  4 -- Full certification authority's certificate in DER encoding
>
> Why not publish the only piece of the certificate that is important in public key cryptography: the public key. ( This is what WebID does currently ) This should be shorter than the certificate, and though it will be longer than the signature, it will be a lot more useful, tying the publisher much less to a particular serialisation format. So you reduce the PGP/X509 disagreements.

Yes. This was asked by others including me as well. People thought it would be no
problem to add this to dane once a bare public key TLS method exists.

>   An important question is of course: how much bandwidth does one save?

Bandwidth does not really matter. What matters is latency (less round trips) and a riddance of ASN.1
parsing.

If you want to help writing a bare public key TLS variant, please contact me.

Paul