Subject: [openpgp] User ID Packet: expand recommendation to include hostname

From: "Neal H. Walfield" <[email-masked]>
Date: Tue, 21 Jul 2015 14:08:16 +0200

Hi,

Simon pointed out to me in another context that the user id (section
5.11 of RFC 4880) is not always in RFC 2822 name-addr format, but is
sometimes simply a hostname.  I think we should expand the
recommendation in that section to cover this usage.

Thanks,

Neal

---

From: Werner Koch <[email-masked]>
Date: Tue, 21 Jul 2015 14:32:29 +0200

> recommendation in that section to cover this usage.

The name-addr convention has served us well for more than 20 years and I
see no reason to explicitly recommend the use of just a hostname.  I see
no problem which will be solved by this.  In case the hostname shall be
used similar to a a user id (e.g. for DNS lookup), it is easier to use a
pseudo mail address like [email-masked].

Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: "Neal H. Walfield" <[email-masked]>
Date: Tue, 21 Jul 2015 19:04:22 +0200

Hi,

At Tue, 21 Jul 2015 14:32:29 +0200,
> pseudo mail address like [email-masked].

I'm not making a recommendation about what should be done, but
suggesting we update the RFC to reflect current practice.

Neal

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 21 Jul 2015 23:15:48 +0200

> suggesting we update the RFC to reflect current practice.

Can you point to existing examples of this usage (by fingerprint,
maybe)?

In the monkeysphere project we use the User ID for servicenames like
ssh://example.com or https://example.com but not raw hostnames.  I don't
think i've seen many raw hostnames, though.

      --dkg

---

From: Derek Atkins <[email-masked]>
Date: Thu, 23 Jul 2015 20:15:39 -0400

> Can you point to existing examples of this usage (by fingerprint,

In my deployment of PGP signatures we're using only FQDNs in the UserID
field in many cases (because they keys are tied to an entity and not a
person).  I'll note that RFC4880 does not specify the contents of the
UserID field, only saying that by convention it's an email address but
not actually REQUIRING it.  I would oppose text that requires an email
address in the ID field.

> think i've seen many raw hostnames, though.

We have a closed system, so we're not using the public keyservers..

>       --dkg

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: "Neal H. Walfield" <[email-masked]>
Date: Sat, 25 Jul 2015 17:47:25 +0200

Hi,

At Tue, 21 Jul 2015 23:15:48 +0200,
> Can you point to existing examples of this usage (by fingerprint,

This usage was pointed out to me by Simon.  I've cc'd him.  I hope
he'll be able to answer your question.  Nevertheless, Derek Atkins'
follow up to your question suggests that at least some people are
using this convention.

Thanks!

:) Neal

---

From: "Neal H. Walfield" <[email-masked]>
Date: Sat, 25 Jul 2015 17:48:36 +0200

At Thu, 23 Jul 2015 20:15:39 -0400,
> not actually REQUIRING it.  I would oppose text that requires an email

I agree with you and I don't think anyone proposed changing this
recommendation.

:) Neal

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 28 Jul 2015 22:56:20 +0200

> follow up to your question suggests that at least some people are

I cannot recall what application this was for, but I distinctly recall
working with OpenPGP keys issued for hostnames in some context.

If nobody has any better pointer than this, I suggest to ignore this
aspect.  I'm not sure adding recommendations about using
[email-masked] is a good idea, so -1 on that -- better to be
silent on things without a use-case.

/Simon