Distributing OpenPGP Key Fingerprints with Signed Keylist Subscriptions
draft-mccain-keylist-05
|
Document |
Type |
|
Active Internet-Draft (individual)
|
|
Last updated |
|
2019-09-02
|
|
Stream |
|
(None)
|
|
Intended RFC status |
|
(None)
|
|
Formats |
|
plain text
xml
pdf
htmlized
bibtex
|
Stream |
Stream state |
|
(No stream defined) |
|
Consensus Boilerplate |
|
Unknown
|
|
RFC Editor Note |
|
(None)
|
IESG |
IESG state |
|
I-D Exists
|
|
Telechat date |
|
|
|
Responsible AD |
|
(None)
|
|
Send notices to |
|
(None)
|
Network Working Group M. McCain
Internet-Draft FLM
Intended status: Standards Track M. Lee
Expires: March 5, 2020 TI
N. Welch
Google
September 2, 2019
Distributing OpenPGP Key Fingerprints with Signed Keylist Subscriptions
draft-mccain-keylist-05
Abstract
This document specifies a system by which an OpenPGP client may
subscribe to an organization's public keylist to keep its keystore
up-to-date with correct keys from the correct keyserver(s), even in
cases where the keys correspond to multiple (potentially
uncontrolled) domains. Ensuring that all members or followers of an
organization have their colleagues' most recent PGP public keys is
critical to maintaining operational security. Without the most
recent keys' fingerprints and a source of trust for those keys (as
this document specifies), users must manually update and sign each
others' keys -- a system that is untenable in larger organizations.
This document proposes a experimental format for the keylist file as
well as requirements for clients who wish to implement this
experimental keylist subscription functionality.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on March 5, 2020.
McCain, et al. Expires March 5, 2020 [Page 1]
Internet-Draft OpenPGP Keylist Subscriptions September 2019
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Notation . . . . . . . . . . . . . . . . . . 3
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
1.3. Note to Readers . . . . . . . . . . . . . . . . . . . . . 3
2. Functions and Procedures . . . . . . . . . . . . . . . . . . 4
2.1. Subscribing to Keylists . . . . . . . . . . . . . . . . . 4
2.2. Automatic Updates . . . . . . . . . . . . . . . . . . . . 4
2.3. Cryptographic Verification of Keylists . . . . . . . . . 6
3. Data Element Formats . . . . . . . . . . . . . . . . . . . . 6
3.1. Keylist . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.2. Signature . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3. Well-Known URL . . . . . . . . . . . . . . . . . . . . . 8
4. Implementation Status . . . . . . . . . . . . . . . . . . . . 8
5. Security Benefits . . . . . . . . . . . . . . . . . . . . . . 8
6. Relation to Other Technologies . . . . . . . . . . . . . . . 8
6.1. Web Key Directories . . . . . . . . . . . . . . . . . . . 9
6.2. OPENPGPKEY DNS Records . . . . . . . . . . . . . . . . . 9
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
9.1. Normative References . . . . . . . . . . . . . . . . . . 9
9.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10
1. Introduction
This document specifies a system by which clients may subscribe to
cryptographically signed 'keylists' of public key fingerprints. The
public keys do not necesssarily all correspond to a single domain.
Show full document text