Re: [openpgp] [dane] Storing public keys in DNS or LDAP, or elsewhere

[Michael Richardson <[e-mail]>]

John Gilmore <[e-mail]> wrote:
    >> For what it is worth, I agree that using the DNS to store per-user data is
    >> not a good approach. The DNS administration model is that it makes
    >> assertions about network names and not individual users. Previous attempts
    >> to put end users in the DNS have uniformly met with failure.
    >>
    >> But that does not mean that LDAP is a useful tool. LDAP has tons of
    >> complexity and none of it does the slightest bit of good.

    > The classic Internet protocol for providing per-user data is "finger",
    > RFC 742 from 1977.  (Note by the way the illustrious users in the
    > "examples" section.)  It has been updated a few times, most recently
    > in RFC 1288 from 1991.  It is a Draft Standard.  Many people put their
    > PGP public key in their .plan file for easy remote access via finger.

    > Finger has two drawbacks for this purpose: It is not authenticated nor
    > encrypted; and it is designed to be human-readable, not
    > machine-readable.  But a simple finger-like protocol, authenticated
    > and encrypted via keys anchored in DNSSEC, might not only fill the
    > need to obtain keys, but also offer a secured and machine-readable
    > replacement for the finger protocol.

Alas, finger ignores the MX records, and the standard client does not pass
the entire command line argument in the query (making multi-tenant hard).

This effectively means that one has to run the fingerd on the web server,
as many want "example.com" to answer the same as "www.example.com", and HTTP
doesn't do SRV lookup either.

If finger could be updated to look up a SRV RR to find the finger server,
it would be very so much easier to deploy.  Given IPv6, putting a unique IP
address per hosted domain isn't so terrible, but having
        % finger [e-mail]

send "[e-mail]" as it's query would help too.

I frankly think that having per-user data in DNS is not a horrible thing.
It is true that the DNS administrators often will not like this, but as was
pointed out in a WG session last week, many them will respond to a request
like:
        "please insert
                user.example.com IN NS ns1.user.example.com"

even when they don't understand:
     "please delegate user.example.com to ns1.user.example.com"

(yes, you can finger me for keys to check this message. John convinced me it
the utility 15 years ago.)

--
Michael Richardson <[e-mail]>, Sandelman Software Works