[Help-gnutls] Re: Semantics of `gnutls_openpgp_key_check_hostname ()'
Daniel Kahn Gillmor
dkg-debian.org at fifthhorseman.net
Wed Apr 11 20:19:13 CEST 2007
-----BEGIN PGP SIGNED MESSAGE-----
On Wed 2007-04-11 12:46:37 -0400, Ludovic Courtès wrote:
> It feels strange to me to fill the user ID packet with something
> that is not an RFC822 mail name, even though this is just a
I agree that it feels strange! But i'm really hoping to see OpenPGP
keys used in place of X.509 certs for TLS, so we need to think about
what's the appropriate thing to put there, and how various Certificate
authorities and clients should interpret it.
The TLS-OpenPGP draft  doesn't seem to say anything about it:
Considerations about the use of the web of trust or identity and
certificate verification procedure are outside the scope of this
document. These are considered issues to be handled by the
application layer protocols.
Is there another draft addressing this issue? I think a declared
convention for certficate verification during a TLS connection would
help folks understand this new model. When you connect to a
TLS-enabled service, you aren't connecting to an RFC 822 e-mail
address. What would you look for in the UID of an OpenPGP-style cert
offered by such a service?
Any thoughts, suggestions, or pointers from other TLS-savvy folks on
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8+ <http://mailcrypt.sourceforge.net/>
-----END PGP SIGNATURE-----
More information about the Gnutls-help