Web Key Discovery

[Peter Lebbing]

On 06/04/18 16:55, Sam Bull wrote:
> The only way for this to work correctly, is if the email address the key has
> been validated for is stored in addition to the key itself. At this point, there
> is no advantage to the user ID matching the address, as you are individually
> storing the addresses you have validated the key for.

WKD and TOFU work on two "problems": discovery and validation. They
specify how to find a key and they give a mechanism to assign a level of
validity to UID's.

What they do not work on is key binding. They do not change how OpenPGP
binds e-mail addresses to keys. OpenPGP does this binding by having UIDs
on keys. The validity of this UID will then still need to be determined;
an invalid UID also does not bind.

What you are proposing is a different mechanism of key binding. While
this is perfectly valid, it is not WKD or TOFU as it is currently
designed, as I understand it. Rather, it is a new design to tackle the
"problem" of key binding.

A good design is more than just noting that "there is no advantage" to
elements of an existing different design and tossing it out. Especially
when there are adversaries involved like in cryptography, you need to
think well about the implications. Preferably you should consider all
aspects well during the design phase, rather than reshape an existing
design that never accounted for the way you will use it now. The history
of cryptography has quite some "D'oh!" moments because people thought
they could bend existing algorithms to perform new tasks. If it was just
Homer Simpson embarassing himself it wouldn't be that bad, unfortunately
the stakes are higher.

HTH,

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at <http://digitalbrains.com/2012/openpgp-key-peter>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20180409/0c4a2b13/attachment.sig>