Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove DANE/OPENPGPKEY support. #17

Merged
merged 1 commit into from
Dec 2, 2017
Merged

Remove DANE/OPENPGPKEY support. #17

merged 1 commit into from
Dec 2, 2017

Conversation

lambdafu
Copy link
Collaborator

@lambdafu lambdafu commented Dec 2, 2017

DANE/OPENPGPKEY is an experimental RFC standard for key retrieval over DNS. This is the authoritative document and informational resources:

I am removing support for this from NeoPG:

  • There is very low adoption. Even the author of the standard (pwouters@redhat.com) does not use it. Of 624 Debian email addresses tested, only two use it.
  • It requires DNSSEC adoption. DNSSEC adoption is low, and setting it up is much more difficult than regular DNS, which is already out of reach for almost all users.
  • GnuPG does not even verify DNSSEC (at all) and just imports over regular DNS, violating the standard. Also, DNS on gnupg.org does not implement DNSSEC.
  • All arguments against key retrieval via DNS apply (web bugs, lack of security in DNS, lack of control over DNS by users, difficulty of setting up DNS records, etc). There is some hand waving in the standard about using TLS in recursive DNS servers, but that's a pipe dream at this point.

In the future, NeoPG will provide an API to extend key retrieval and trust evaluation, allowing such experimental protocols to be included in applications without tainting the core code base.

@lambdafu lambdafu merged commit ef30acd into master Dec 2, 2017
@lambdafu lambdafu deleted the no-dane branch December 2, 2017 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant