[openpgp] Re: Certificate discovery over HKP

[Andrew Gallagher <[e-mail]>]

On 8 Apr 2025, at 20:41, Vincent Breitmoser <look=[e-mail]> wrote:
> 
> I read the document you linked, and the first question I have is - what exactly is the "thing to be done" here that we are trying to solve? It is unclear to me both what the exact goals are, and how HKP is the best way achieve them.
> 
> "OpenPGP certificate discovery over HKP" sounds like we are designing a technical alternative to WKD, but what are the properties we want?

The first few messages in the old thread I linked lay out the general idea. WKD has some unusual properties that make it more difficult than necessary to implement, particularly the hashing scheme, which prevents things like case or special character normalisation. For example, gmail maps john.doe(at)gmail.com and johndoe(at)gmail.com to the same account. Hashing prevents these from being easily identified by the server, hence WKD lookups are now required to send both the hashed and unhashed forms of the same address. Also, the form of the policy file causes issues with some web hosters, and the requirement for the policy file and the actual certificates to be served from the same hostname means that a shared service provider (such as KOO) has to implement a certificate infrastructure. On the other hand, a simpler indirection format allows an existing keyserver to serve certs for discovery using a single lookup protocol. And finally, we cannot safely serve v6 keys over existing WKD for fear of compatibility issues with unpatched legacy code.

> If it's to allow "recursive" lookups, we could just add a line to the wkd policy file that allows it. Or, even easier, servers could just do it without asking, since certificates available via WKD must be considered public info (modulo enumeration) anyways.

Yes, one way of implementing recursive lookups would be to just do them all the time. We would need some form of annotation though to distinguish certs that had been proxied from an authoritative source from those that had not. But the primary goal of discovery over HKP is not to enable recursive lookups, the causality is the other way around.

A