Re: [Help-gnutls] Re: OpenPGP certificate verification for TLS connections

[Rupert Kittinger-Sereinig]

Ludovic Courtès schrieb:
...
> > One example: a secure messaging service could have millions of
> > users. A gnupg keyring of this size may be a bit problematic, but a
> > database should handle this easily. To validate a client connection in
> > this scenario, we would need to:
> > - check for a trusted signature (including expiry and revocation), we
> > can keep this as simple as checking for one trusted key if we want.
>
> What do you mean by "trusted signature"?  Something like an
> "authorization certificate" signed by a "trusted authority" (see my
> previous post)?

I mean trusted in the sense of the pgp trustdb. Ideally, every user 
should be able to configure how he wants to construct his web of trust.

E.g. for a server application, the admin could choose a handfull of 
"user managers" whose keys he would put in the keyring and assign 
ultimte trust to each one.

Another example: a user of web services could validate the server key 
fingerprint, and locally sign them with his own key.

> > - now that we know the ID is authentic, we can look it up in the
> > database and decide what the client is allowed to do.

One more point: even if the user id is relevant and not the key, key 
revocation must still ber handled on a key basis. But this is only 
necessary for key compromise, which should be a rare event. If a user 
should be denied access, this can be handled via his id.

> > As for he content of ids, I agree with Daniel: using URIs seems the
> > logical choice to me, at least for servers.
>
> Why?  How does this derive from the authorization scheme you just
> sketched?

I did not want to imply that this follows from the first part, I just 
wanted to say I think it is the right thing to do :-)

To be more precise, I would suggest using URIs a defined in RFC 2396, 
section 3, without the additional restriction that the path and query 
components must be empty.

Since this is also a straightforward method to define how to access the 
server, it should be easy for the client to check.

cheers,
Rupert

--
Rupert Kittinger-Sereinig <address@hidden>
Krenngasse 32
A-8010 Graz
Austria