Re: [openpgp] Transport public keys inside the message body

[Simon Josefsson <[e-mail]>]

Kai Engert <[e-mail]> writes:

> Hi Simon,
>
> On 15.02.24 09:02, Simon Josefsson wrote:
>> I re-read RFC 3156 and one way to do this is "extend" it by allowing
>> putting a public key block before or after the '-----BEGIN PGP
>> MESSAGE-----' block, and say that MUAs can parse those blocks to find
>> keys.  Yes, that is a bit ugly, but overall complexity is lower than
>> having multipart MIME blobs with an extra application/pgp-keys
>> component, and solves the problem of locating which public key was (by
>> the sender) intended for use with the signature.
>
> As I understand it, your proposed solution is limited to transport the
> key in signed and/or encrypted messages.
>
> It might be useful to specify a mechanism to transport the key in
> messages that are neither signed nor encrypted, and which don't
> include a "BEGIN PGP MESSAGE".
>
> A more general solution could allow users to include their public key
> in all messages they send.

Are you aware of application/pgp-keys?

It can be included anywhere as a MIME part with any size of keys
already, see:

https://datatracker.ietf.org/doc/html/rfc3156#section-7

I assumed that you knew about it, were frustrated with its poor
semantics, and wanted to explore alternatives.

I recall seeing some people send their signed e-mails with an additional
application/pgp-keys MIME part to distribute the keys, but don't have
any direct example.

In many receivers, this practice leads to poor UX, but maybe that is the
problem rathern than use of application/pgp-keys.

>> Maybe the old OpenPGP: e-mail header with fingerprint and URL should be
>> revived...  https://josefsson.org/openpgp-header/ and
>> https://datatracker.ietf.org/doc/html/draft-josefsson-openpgp-mailnews-header
>
> I don't mind encouraging MUAs to include this header, if possible, but
> it seems the header couldn't solve the goal for a significant number
> of users, who may not know how to make their public key accessible at
> an URL.

MUAs can upload the user's key to a key server, and then include a
OpenPGP: header with a URL pointing to that key server.  Upload to a key
server and recording the URL as a OpenPGP annotation inside the key
(which MUAs could use to populate the OpenPGP: header) could be an
optional step during private key creation.

/Simon