Subject: [openpgp] Question on WKD, Key Discovery

From: juga <[email-masked]>
Date: Thu, 09 May 2019 12:48:00 +0000

Hi,

The last version of the draft [0] states:

  Only if the required sub-domain does not exist, they SHOULD
  fall back to the direct method.

Should implementations fall back to the direct method on any error
trying to fetch the key with the advanced method and not just when the
sub-domain doesn't exist?.

I can think of situations where an organization is migrating to the
advanced method and the sub-domain exists, but for example, they don't
have a valid certificate for the sub-domain yet or they haven't created
the file system structure yet.

Wouldn't be better to still try to fetch a key with the direct method
than not returning any key?.

Maybe there're good reasons to don't do this, that i'm unaware of.

Thanks,
juga.

[0]
https://datatracker.ietf.org/doc/html/draft-koch-openpgp-webkey-service-07#section-3.1

---

From: Paul Wouters <[email-masked]>
Date: Thu, 9 May 2019 09:51:19 -0400 (EDT)

> sub-domain doesn't exist?.

The SHOULD there is tricky. Unless you are using DNSSEC, the question
of "does a domain not exist" is very vulnerable to spoofing by an
attacker.

Paul