Subject: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 15 Aug 2008 12:20:25 +1000

Please adopt
http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
as a working group document. This document is trying to describe how to
utilise ASN.1 attributes with OpenPGP keys, the focus is to further
promote the use of OpenPGP keys for server purposes, however some people
expressed interest in other extensions that are more appropriate for
individuals.

-- 

Best regards,
 Duane

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 15 Aug 2008 17:07:42 +0200

> expressed interest in other extensions that are more appropriate for

Your document reuse subjectAltNames from PKIX.  While I think that is a
nice idea that allows to re-use their flexibility, I think the wisdom of
using ASN.1/DER and PKIX in OpenPGP should be challenged.

Let me propose that your document specify an OpenPGP attribute 'dnsName'
that contains a UTF-8 string with a DNS domain name, and explain how
wildcard *.example.com names should be dealt with.  No ASN.1/DER
encodings and no PKIX terminology.

This would solve your use case, RFC 5081, without having OpenPGP
implementations need to implement PKIX.

Thoughts?

Thanks,
Simon

---

From: Duane at e164 dot org <[email-masked]>
Date: Sat, 16 Aug 2008 01:18:12 +1000

> encodings and no PKIX terminology.

Even PKIX doesn't stipulate how wildcards should be handled, and so we
have multiple browsers doing multiple things.

> implementations need to implement PKIX.

I started off down this path, but then you need at least 7 or 8
different extensions alone to deal with common subject Alt Names, DNS,
O, OU, C, ST, L etc where as using PKIX references they maintain the
table, or who ever is in charge of a particular OID subset of the tree.

-- 

Best regards,
 Duane

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 16 Aug 2008 00:49:14 +0200

> have multiple browsers doing multiple things.

RFC 2818 specify how it should be handled for TLS, but you are most
likely correct that multiple browsers doesn't implement it properly.

> table, or who ever is in charge of a particular OID subset of the tree.

Is there a use case in OpenPGP for any other alt name than dnsName?

/Simon

---

From: Duane at e164 dot org <[email-masked]>
Date: Sat, 16 Aug 2008 12:22:34 +1000

> likely correct that multiple browsers doesn't implement it properly.

It only specifies that wildcard(s) are valid for 1 level of hostname(s),
it doesn't clarify the issue of multiple wildcards per hostname(s) being
valid or not and this is where the browsers start doing their own thing.

> Is there a use case in OpenPGP for any other alt name than dnsName?

That's the whole point of this draft, people (including myself) want
more than just a hostname(s), otherwise we could have just re-used the
user-id field for the dns name(s).

-- 

Best regards,
 Duane

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 16 Aug 2008 12:17:48 +0200

> user-id field for the dns name(s).

Ok.  I suggest to explain (in the document) these use cases and to
broaden the abstract -- right now the abstract strongly implies to me
that you only intend the use-case to be OpenPGP in TLS:

Abstract

   A RFC was accepted extending TLS usage to include OpenPGP keys (RFC
   5081) as an alternative or in addition to X.509 certificates,
   however the author did not really standardise the way the
   information in OpenPGP keys was to be presented and this could be
   detrimental or fragment efforts to utilise OpenPGP keys in this
   manner.

Other than that, I don't have any comments.  I believe that an OpenPGP
extension mechanism that carry DNS hostnames are needed, so I'd like
your solution (or something like it) move forward.

Thanks,
/Simon

---

From: Duane at e164 dot org <[email-masked]>
Date: Sat, 16 Aug 2008 23:11:12 +1000

> that you only intend the use-case to be OpenPGP in TLS:

Server uses of which TLS is going to be the biggest use case is the main
objective at present, most server certificates in the X.509 world have a
lot more than just dnsName, such as company name, maybe a contact, the
country, state/territory/province, town/suburb and so on and so forth.

However I have a secondary internet draft that depends on this one that
I'm currently in the process of writing and so on that I'd like to use
OpenPGP keys for DNS encryption.

Most recently draft published to the IETF site:

http://www.ietf.org/internet-drafts/draft-groth-dns-encryption-02.txt

However this has now changed substantially, and the current draft is here:

http://open-pgp.info/wiki/index.php?title=DNS_Encryption_Draft

Along with a bunch of text I have no idea what to do with:

http://open-pgp.info/wiki/index.php?title=Why_X.509_is_Bad

-- 

Best regards,
 Duane

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 16 Aug 2008 15:22:50 +0200

> http://open-pgp.info/wiki/index.php?title=DNS_Encryption_Draft

Cool!  Why don't you use RFC 4398 to store OpenPGP keys in the DNS,
rather than adding a new RR type?

/Simon

---

From: Duane at e164 dot org <[email-masked]>
Date: Sat, 16 Aug 2008 23:24:49 +1000

> rather than adding a new RR type?

The current draft is based on suggestions from the namedroppers list,
however I've put it on hold till the OpenPGP stuff gets dealt with.

-- 

Best regards,
 Duane

---

From: Duane at e164 dot org <[email-masked]>
Date: Sun, 17 Aug 2008 01:56:22 +1000

Simon Josefsson wrote:

You might want to look at this:

http://open-pgp.info/wiki/index.php?title=Talk:Standardisation_of_OpenPGP_Keys_for_Server_Purposes

Has some of the discussion surrounding decisions made on the draft.

-- 

Best regards,
 Duane

---

From: Florian Weimer <[email-masked]>
Date: Sat, 16 Aug 2008 22:38:08 +0200

> country, state/territory/province, town/suburb and so on and so forth.

This data is not mechanically processed (at least not in a way which is
consistent across implementations), so you can put it into notation data
subpackets.

---

From: Duane at e164 dot org <[email-masked]>
Date: Sun, 17 Aug 2008 10:22:05 +1000

> consistent across implementations), so you can put it into notation data

What is a notation data subpacket?

Or more to the point, what section of what RFC can be used to reference
it etc?

-- 

Best regards,
 Duane

---

From: Florian Weimer <[email-masked]>
Date: Sun, 17 Aug 2008 11:32:52 +0200

* Duane at:

> What is a notation data subpacket?

It's a term straight from RFC 4880.  Sorry, I don't know how to be more
precise.

---

From: Werner Koch <[email-masked]>
Date: Mon, 18 Aug 2008 11:15:01 +0200

> It's a term straight from RFC 4880.  Sorry, I don't know how to be more

Notation data means in OpenPGP additional data associated with a
signatures (key or data signature).  This is basically the sdame as
certificate extensions and signaed attribuest in X.509.

Note that notation data is not the same as a user ID but data associated
for example with a user ID.  Grep the gpg man page for "notation" to see
how to use them in that application.

Salam-Shalom,

   Werner

-- 
Linux-Kongress 2008 + Hamburg + October 7-10 + www.linux-kongress.org

   Die Gedanken sind frei.  Auschnahme regelt ein Bundeschgesetz.

---

From: Duane at e164 dot org <[email-masked]>
Date: Mon, 18 Aug 2008 20:26:49 +1000

Simon Josefsson wrote:
> Florian Weimer <[email-masked]> writes:
> 
>> * Duane at:
>>
> Right, however, the TLS server name needs to be mechanically processed,
> so it needs a different mechanism -- such as a new OpenPGP extension
> that contains a single UTF-8 string intended for identification of
> TLS+OpenPGP servers.

The other information needs to be verified in a similar manner as well,
otherwise the information is much less useful.

Also a single website can have multiple hostnames.

-- 

Best regards,
 Duane

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 18 Aug 2008 12:20:19 +0200

/Simon

---

From: Jon Callas <[email-masked]>
Date: Mon, 18 Aug 2008 09:16:12 -0700

> Or more to the point, what section of what RFC can be used to  

http://tools.ietf.org/html/rfc4880#section-5.2.3.16

	Jon

---

From: Duane at e164 dot org <[email-masked]>
Date: Sat, 23 Aug 2008 12:27:20 +1000

> Also a single website can have multiple hostnames.

If all the information submitted needs verifying before being signed by
others is notation data sub packets the most suitable way to do this?

-- 

Best regards,
 Duane

---

From: Florian Weimer <[email-masked]>
Date: Sun, 31 Aug 2008 11:12:29 +0200

> that contains a single UTF-8 string intended for identification of

Hmm.  There is no automatic trust model for TLS/OpenPGP, so I guess you
need to configure keys explicitly.  In this case, you'd not just record
the fingerprint, but also the domain name.  Problem solved.

(If you want indirection, you can configure signing keys plus a notation
name of the signature notation data subpacket to consider.)

From: Florian Weimer <[email-masked]>
To: Simon Josefsson <[email-masked]>
Cc: Duane at e164 dot org <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Date: Sun, 31 Aug 2008 11:12:29 +0200
Sender: [email-masked]

> that contains a single UTF-8 string intended for identification of

Hmm.  There is no automatic trust model for TLS/OpenPGP, so I guess you
need to configure keys explicitly.  In this case, you'd not just record
the fingerprint, but also the domain name.  Problem solved.

(If you want indirection, you can configure signing keys plus a notation
name of the signature notation data subpacket to consider.)

Date: Sat, 23 Aug 2008 12:27:20 +1000
From: Duane at e164 dot org <[email-masked]>
To: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

-- 

Best regards,
 Duane

From: Jon Callas <[email-masked]>
To: Duane <[email-masked]>, OpenPGP <[email-masked]>
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Date: Mon, 18 Aug 2008 09:16:12 -0700
Sender: [email-masked]

	Jon

Date: Mon, 18 Aug 2008 20:26:49 +1000
From: Duane at e164 dot org <[email-masked]>
To: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

-- 

Best regards,
 Duane

From: Simon Josefsson <[email-masked]>
To: Florian Weimer <[email-masked]>
Cc: Duane at e164 dot org <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Mon, 18 Aug 2008 12:20:19 +0200
Sender: [email-masked]

/Simon

From: Werner Koch <[email-masked]>
To: Florian Weimer <[email-masked]>
Cc: Duane at e164 dot org <[email-masked]>, Simon Josefsson <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Organisation: g10 Code GmbH
OpenPGP: id=5B0358A2; url=finger:[email-masked]
Date: Mon, 18 Aug 2008 11:15:01 +0200
Sender: [email-masked]

Salam-Shalom,

   Werner

From: Florian Weimer <[email-masked]>
To: Duane at e164 dot org <[email-masked]>
Cc: Simon Josefsson <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Date: Sun, 17 Aug 2008 11:32:52 +0200
Sender: [email-masked]

* Duane at:

Date: Sun, 17 Aug 2008 10:22:05 +1000
From: Duane at e164 dot org <[email-masked]>
To: Florian Weimer <[email-masked]>
CC: Simon Josefsson <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

-- 

Best regards,
 Duane

From: Florian Weimer <[email-masked]>
To: Duane at e164 dot org <[email-masked]>
Cc: Simon Josefsson <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Date: Sat, 16 Aug 2008 22:38:08 +0200
Sender: [email-masked]

Date: Sun, 17 Aug 2008 01:56:22 +1000
From: Duane at e164 dot org <[email-masked]>
To: Simon Josefsson <[email-masked]>
CC: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

Simon Josefsson wrote:

-- 

Best regards,
 Duane

Date: Sat, 16 Aug 2008 23:24:49 +1000
From: Duane at e164 dot org <[email-masked]>
To: Simon Josefsson <[email-masked]>, [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

-- 

Best regards,
 Duane

From: Simon Josefsson <[email-masked]>
To: Duane at e164 dot org <[email-masked]>
Cc: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Sat, 16 Aug 2008 15:22:50 +0200
Sender: [email-masked]

/Simon

Date: Sat, 16 Aug 2008 23:11:12 +1000
From: Duane at e164 dot org <[email-masked]>
To: Simon Josefsson <[email-masked]>
CC: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

-- 

Best regards,
 Duane

From: Simon Josefsson <[email-masked]>
To: Duane at e164 dot org <[email-masked]>
Cc: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Sat, 16 Aug 2008 12:17:48 +0200
Sender: [email-masked]

Abstract

Thanks,
/Simon

Date: Sat, 16 Aug 2008 12:22:34 +1000
From: Duane at e164 dot org <[email-masked]>
To: Simon Josefsson <[email-masked]>
CC: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

-- 

Best regards,
 Duane

From: Simon Josefsson <[email-masked]>
To: Duane at e164 dot org <[email-masked]>
Cc: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Sat, 16 Aug 2008 00:49:14 +0200
Sender: [email-masked]

/Simon

Date: Sat, 16 Aug 2008 01:18:12 +1000
From: Duane at e164 dot org <[email-masked]>
To: Simon Josefsson <[email-masked]>
CC: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig6848D9902416F4FFAD5F6BF3
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Simon Josefsson wrote:

> Let me propose that your document specify an OpenPGP attribute 'dnsName=
'

--=20

Best regards,
 Duane

--------------enig6848D9902416F4FFAD5F6BF3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

--------------enig6848D9902416F4FFAD5F6BF3--

From: Simon Josefsson <[email-masked]>
To: Duane at e164 dot org <[email-masked]>
Cc: [email-masked]
Subject: Re: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Fri, 15 Aug 2008 17:07:42 +0200
Sender: [email-masked]

Thoughts?

Thanks,
Simon

From: David Shaw <[email-masked]>
To: OpenPGP <[email-masked]>
Subject: Camellia draft
Date: Thu, 14 Aug 2008 22:56:54 -0400
Sender: [email-masked]

Is being tracked:

https://datatracker.ietf.org/idtracker/draft-ietf-openpgp-camellia/

David

Date: Fri, 15 Aug 2008 12:20:25 +1000
From: Duane at e164 dot org <[email-masked]>
To: [email-masked]
Subject: Please adopt http://www.ietf.org/internet-drafts/draft-groth-openpgp-attribute-extension-00.txt
Sender: [email-masked]

Please adopt

-- 

Best regards,
 Duane