[openpgp] Re: Certificate discovery over HKP

[Vincent Breitmoser <[e-mail]>]

Hi Andrew and list,

On 08.04.25 23:00, Andrew Gallagher wrote:
> The first few messages in the old thread I linked lay out the general idea. WKD has some unusual properties that make it more difficult than necessary to implement, particularly the hashing scheme, which prevents things like case or special character normalisation. For example, gmail maps john.doe(at)gmail.com and johndoe(at)gmail.com to the same account. Hashing prevents these from being easily identified by the server, hence WKD lookups are now required to send both the hashed and unhashed forms of the same address. Also, the form of the policy file causes issues with some web hosters, and the requirement for the policy file and the actual certificates to be served from the same hostname means that a shared service provider (such as KOO) has to implement a certificate infrastructure. On the other hand, a simpler indirection format allows an existing keyserver to serve certs for discovery using a single lookup protocol. And finally, we cannot safely serve v6 keys over existing WKD for fear of compatibility issues with unpatched legacy code.

Thanks for explaining.

I don't want to be too dismissive of these efforts, but personally I'm 
not convinced of the value proposition. WKD took us a decade to get to a 
relatively stable state, and there are now finally some tens of 
thousands of domains that use it. The features listed here do not 
warrant a competing standard imo, unless WKD is completely stuck as a 
spec - which I don't think (hope) it is.

That said, y'all summit goers have certainly thought this through more 
than I have. Perhaps I'm missing some pieces of the picture.

Cheers

  - V