Subject: [saag] Best practices for verifying authenticity of OpenPGP keys?

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 14 Apr 2021 22:32:47 -0400

(this is another issue that was recently raised by an implementer of
"security.txt")

What is the current best practice for verifying whether a given
OpenPGP key is real and valid? Not clear if Web of Trust is widely
used anymore, PKI isn't applicable and public keyservers have been
targeted in the past by poisoning attacks.

To me, the most common approach seems to be publishing the keys or
their fingerprints on the web where they can be retrieved with TLS,
essentially relying on public PKI. This appears to be the approach
used by OpenSSL, Tails, Tor, etc.

See:
https://www.openssl.org/community/omc.html
https://tails.boum.org/install/mac/usb-download/index.en.html
https://support.torproject.org/tbb/how-to-verify-signature/

Thanks

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 15 Apr 2021 12:18:02 +0200

> used by OpenSSL, Tails, Tor, etc.

Indeed, see:
https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-11

/Simon

---

From: Randy Bush <[email-masked]>
Date: Thu, 15 Apr 2021 12:58:29 -0700

> https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-11

use and like

randy

---
[email-masked]
`gpg --locate-external-keys --auto-key-locate wkd [email-masked]`
signatures are back, thanks to dmarc header butchery