Subject: Re: [keyassure] publishing the public key

From: Paul Wouters <[email-masked]>
Date: Mon, 14 Feb 2011 20:35:16 -0500 (EST)

On Tue, 15 Feb 2011, Peter Gutmann wrote:

>> The public key's type and raw blob will be obtained from DNSSEC, so this is
>> no longer required to be conveyed to the client from the server via a PKIX
>> certificate or other ASN.1 structures.
>
> But what format is the "type and raw blob" in?  You need some way of encoding
> it, and if it's not the standard ASN.1 format what are you going to use?

I'm not sure I understand your question. The key would encoded in DNS, likely in a
format similar to DNSKEY.

Paul

---

From: Warren Kumari <[email-masked]>
Date: Mon, 14 Feb 2011 21:26:14 -0500

[ Subject updated to include the issue number - apologies if this makes your MUA crazy. ] 

We have this particular item listed as an issue in the issue tracker so I figured that we might as well keep track of the progress we are making on this, so let's discuss it an issue and figure out how / what we would like to do about it[0]... (Also known as, issue #14 is officially open :-))

W

[0]: Yes, I realize that we are already discussing it, but I'm trying hard to use the issue tracker to actually work through the open issues, track what we are deciding, etc. I have seen it being used very effectively, especially to help newcomers understand what has been discussed and what has been decided.

On Feb 14, 2011, at 8:35 PM, Paul Wouters wrote:

> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure
>

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 14 Feb 2011 18:35:23 -0800

Personally, I don't see much use for bare public keys, but I hear that 
many people do, and I don't see much harm in adding them.

However, if the WG wants to add them, I would want to see some wording 
for how the on-the-wire format would look. That is, you can't just put 
the bits of the public key there: you also have to say what the 
signature algorithm is and, if the algorithm requires parameters, what 
the parameters are.

Any of the folks who seem most in favor of this: please suggest some 
wording here. You need to say what the format is and how the TLS client 
would compare the value gotten from the TLSA RR with the certificate 
they get in the TLS handshake.

--Paul Hoffman

---

From: Henry Story <[email-masked]>
Date: Tue, 15 Feb 2011 12:46:34 +0100

> format similar to DNSKEY.

Or you just put the key info in ASN.1 format (Abstract Syntax Notation 1). ASN.1 
is just like XML in this respect - both are syntaxes.  Instead of URIs for namespaces 
they use  registered numbers. And  there is part of the X509 tree of information
a subtree for describing public keys. Just take that subtree.  

I don't know where that is defined though, though I think I came across it last
year.

Henry

> Paul

Social Web Architect
http://bblfish.net/