From: Andrew Gallagher <andrewg@andrewg.com>
Message-Id: <758335F4-6A25-445C-8836-69FAA17E4A44@andrewg.com>
Content-Type: multipart/signed;
	boundary="Apple-Mail=_7996ACA5-14D6-4E79-A96A-35EA9EB953B2";
	protocol="application/pgp-signature";
	micalg=pgp-sha512
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6.1.9\))
Date: Wed, 12 Feb 2025 11:52:39 +0000
In-Reply-To: 
 <CAMm+LwgxtvAhqqjCayqEzUcQcezJDLBTLW=Fza149vYGK=gheQ@mail.gmail.com>
To: Phillip Hallam-Baker <phill@hallambaker.com>
References: 
 <CAMm+LwgxtvAhqqjCayqEzUcQcezJDLBTLW=Fza149vYGK=gheQ@mail.gmail.com>
Message-ID-Hash: W7DGND2HSJRYNUVOWORB5OMQLJJLP4IO
CC: IETF OpenPGP <openpgp@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5Bopenpgp=5D_Re=3A_Using_DNS_Handles_with_OpenPGP?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/openpgp/RkxHnJ3MNUmJWC24clmHWzxyE0Y>


--Apple-Mail=_7996ACA5-14D6-4E79-A96A-35EA9EB953B2
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_67153770-91B7-4DB3-9BE6-10901339BF05"


--Apple-Mail=_67153770-91B7-4DB3-9BE6-10901339BF05
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Hi, Phillip.

On 7 Feb 2025, at 21:29, Phillip Hallam-Baker <phill@hallambaker.com> =
wrote:
>=20
> So putting OpenPGP keys into the DNS directly seems like a bad idea. =
Better to use signed contacts and put the root of trust for the contact =
manager into the DNS:
>=20
> _mesh.phill.hallambaker.com <http://mesh.phill.hallambaker.com/>. IN =
TXT "dsa=3Dmbqn-a3es-zbye-xp3o-w6et-pqug-go5v@@example.com =
<http://example.com/>"
>=20
> So what this does is bind my DNS handle to my Mesh direct service =
address which is a root-o-trust/service address pair. And then people =
can do a fetch to get my public contact assertion signed under that root =
o' trust and verify it. If my zone is DNSSEC signed, we have a fairly =
solid trust path for establishing TOFU.
>=20
> And that contact assertion would hold my SSH credentials OpenPGP =
credentials, etc. etc. Right now I am just transferring the IANA =
protocol names into my JSON serialization.

This proposal sounds to me like it can already be done by combining WKD =
and Keyoxide [1] - WKD binds the key to the domain, and Keyoxide binds =
the various other identities to the key. Or am I missing an extra =
subtlety?

A

[1] www.keyoxide.org

--Apple-Mail=_67153770-91B7-4DB3-9BE6-10901339BF05
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; =
charset=3Dus-ascii"></head><body style=3D"overflow-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;">Hi, =
Phillip.<br><div><br></div><div>On 7 Feb 2025, at 21:29, Phillip =
Hallam-Baker &lt;phill@hallambaker.com&gt; wrote:<br><blockquote =
type=3D"cite"><div><div dir=3D"ltr"><div class=3D"gmail_default" =
style=3D"font-size:small"><br></div><div class=3D"gmail_default" =
style=3D"font-size:small">So putting OpenPGP keys into the DNS directly =
seems like a bad idea. Better to use signed contacts and put the root of =
trust for the contact manager into the DNS:</div><div =
class=3D"gmail_default" style=3D"font-size:small"><br></div><div =
class=3D"gmail_default" style=3D"font-size:small">_<a =
href=3D"http://mesh.phill.hallambaker.com/">mesh.phill.hallambaker.com</a>=
. IN TXT "dsa=3Dmbqn-a3es-zbye-xp3o-w6et-pqug-go5v@@<a =
href=3D"http://example.com/">example.com</a>"</div><div =
class=3D"gmail_default" style=3D"font-size:small"><br></div><div =
class=3D"gmail_default" style=3D"font-size:small">So what this does is =
bind my DNS handle to my Mesh direct service address which is a =
root-o-trust/service address pair. And then people can do a fetch to get =
my public contact assertion signed under that root o' trust and verify =
it. If my zone is DNSSEC signed, we have a fairly solid trust path for =
establishing TOFU.</div><div class=3D"gmail_default" =
style=3D"font-size:small"><br></div><div class=3D"gmail_default" =
style=3D"font-size:small">And that contact assertion would hold my SSH =
credentials OpenPGP credentials, etc. etc. Right now I am just =
transferring the IANA protocol names into my JSON =
serialization.</div></div></div></blockquote><br></div><div>This =
proposal sounds to me like it can already be done by combining WKD and =
Keyoxide [1] - WKD binds the key to the domain, and Keyoxide binds the =
various other identities to the key. Or am I missing an extra =
subtlety?</div><div><br></div><div>A</div><div><br></div><div>[1] =
www.keyoxide.org</div></body></html>=

--Apple-Mail=_67153770-91B7-4DB3-9BE6-10901339BF05--

--Apple-Mail=_7996ACA5-14D6-4E79-A96A-35EA9EB953B2
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKR55odxVrielLu+DXB7EBNWQZikFAmesi4cACgkQXB7EBNWQ
Zinb8w//YjsRqdFx3+WykA+BESfuT6NLiAU2q2L96eG6OztW6rsCFKkGU+1Rq4Lj
/VddBYvKpEdcaRUeiI3A+hIO+730KxcWrQgulHM2kmsH0HYor3oczqHBL8mZlnvj
hCYBsKs//2i2ONOUymdSQg0Lx0tI5IQgSevFasQLtG1tEISIjsXzEIIMYTOqEs9q
FbWJlt66g7i6DAGl+MTGe2HfRhmDON0dGiasAQvfVyGf44LCFW6ge+QDSFcSI2Pq
xaAdGZzgHPHJ4FSoqYRkO/pBkl9ohshJp9fG2uxbfDLIrrr4duawhHYrXlmWiYiG
sNF27NKvt/dsuwvUzRharQXTQxWCJ9SfBwkv113G+b1hy+EXR5JaRwAlvz1Mqvz1
8kM0lZC+rre2l1M42PJFujp3JQ+4GGz3kU9Qr7DsQ8OLVqTk3QKORMmAtxusqeV4
K5Hhsfve8O8dPlNqtphc4NniTta6RCNtJ4q8FYUD+eNaaHJSvgPuQO+euGcelbcX
aPN9n86c4Zf6QcltdvKuN91zPn7c6ACiu4XYq7NOL+4mGbBLFLlb6j1wA5FWK3Ad
/e/4HVVrOyRNOXtVwQQC/3P6ywgLxE8o3OVxpsYts/ZZ/NgL8cVm2uXFIX/rkedu
pnMaTWWgzFJH0k9m1WM+kfhP4x8AEoNowCpd5GcIhqJX1JHVfoI=
=wcU6
-----END PGP SIGNATURE-----

--Apple-Mail=_7996ACA5-14D6-4E79-A96A-35EA9EB953B2--