[openpgp] Re: Using DNS Handles with OpenPGP

[Phillip Hallam-Baker <[e-mail]>]

I have revised my approach substantially since. The Mesh is now gone from
my scheme, I am using JSContact instead. The only Mesh technology I am
using now is UDF which is basically a better way to do fingerprints with
Base32 that makes them suited for a bunch of purposes without conflicts.
And I am only using a very small part of that.

This approach is very similar to what you propose with KeyOxide, but
JSContact seems to be pretty well thought out as far as working with
OpenPGP and S/MIME for email security, there is a currently active IETF WG.
I think there would have to be a pretty good reason not to use JSContact
before looking outside IETF.

Putting WKD information into the contact is obviously a good idea.


On Wed, Feb 12, 2025 at 6:52 AM Andrew Gallagher <[e-mail]>
wrote:

> Hi, Phillip.
>
> On 7 Feb 2025, at 21:29, Phillip Hallam-Baker <[e-mail]>
> wrote:
>
>
> So putting OpenPGP keys into the DNS directly seems like a bad idea.
> Better to use signed contacts and put the root of trust for the contact
> manager into the DNS:
>
> _mesh.phill.hallambaker.com. IN TXT
> "dsa=mbqn-a3es-zbye-xp3o-w6et-pqug-go5v@@example.com"
>
> So what this does is bind my DNS handle to my Mesh direct service address
> which is a root-o-trust/service address pair. And then people can do a
> fetch to get my public contact assertion signed under that root o' trust
> and verify it. If my zone is DNSSEC signed, we have a fairly solid trust
> path for establishing TOFU.
>
> And that contact assertion would hold my SSH credentials OpenPGP
> credentials, etc. etc. Right now I am just transferring the IANA protocol
> names into my JSON serialization.
>
>
> This proposal sounds to me like it can already be done by combining WKD
> and Keyoxide [1] - WKD binds the key to the domain, and Keyoxide binds the
> various other identities to the key. Or am I missing an extra subtlety?
>
> A
>
> [1] www.keyoxide.org
>