On 11/03/2012 03:26 PM, Nikos Mavrogiannopoulos wrote: > It seem that the IETF TLS working group is defining a new certificate > type extension, which in short makes the openpgp certificate type > extension obsolete. The authors of the new draft are not very keen into > adding the openpgp key type into the new certificate type extension, > based on the fact that this is not widely used. So my question is does > it really make sense to pursue that? Are there applications using gnutls > with openpgp keys? > > And even more, if it is shown they are not widely used, does it make > sense to support openpgp keys in gnutls at all?
given the hassle involved in convincing other major TLS implementations to adopt TLS extensions, and the lack of adoption of OpenPGP certificates in TLS in general, i've been thinking recently that the simpler approach is just to propose and implement new "standards" within the X.509 space and allow the verifiers to transform the weird certificates on either side. The worst thing that happens there is something akin to a browser warning; and if you can propose an X.509 verification routine or plugin for the peers, it's possibly narrower in scope than asking for a TLS extension. The downside of this approach, of course, is that there's no clear way to signal that a non-standard X.509 certificate would be acceptable for the remote peer :( Oh, and the other major downside of course is that the X.509 format is a really ungainly one, if you had to choose a generic container. I'm pretty disheartened by the TLS WG's rationales for discarding RFC 6091 when working on oob-key, though. If the main concern is that there isn't a mechanism for indicating the difference between what kinds of certificates you're prepared to offer, and what kind of certificates you're prepared to accept, then it seems to me that should be fixed as a revision of 6091, rather than maintain two separate registries of certificate types. I'd reply with something like this on the IETF list, but i'm not sure how useful that would be, given the back-and-forth you've already had. Any thoughts on what sort of feedback i might give that would be useful? --dkg
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Help-gnutls mailing list Help-gnutls@gnu.org https://lists.gnu.org/mailman/listinfo/help-gnutls