On Thu, 15 Oct 2009, David Shaw wrote:
David,
For starters let me thank you on both the fullness and the expedience of
your answer. Far too many open source projects just go "crickets" when I
send out a laundry list, and I need to recognize your time. Let me also
apologize in advance for my wordiness. We have quite a bit of ground to
cover.
On Oct 15, 2009, at 9:37 PM, Dan Mahoney, System Admin wrote:
1) Currently the only tool that can generate a CERT record, make-dns-cert,
is not built or packaged by default under any os I've found (I've tried
FreeBSD and ubuntu). It has no documentation, no examples, and only a
terse 4-line usage summary. I've also seen a few bugs reported with it,
that I don't know if they're fixed, such as not handling whitespace in the
key fingerprint properly.
I was referencing this thread:
http://lists.gnupg.org/pipermail/gnupg-users/2006-April/028314.html
If that's no longer the case, then no worry. I suppose if doc were more
abundant I wouldn't have had to pore over old mailing list entries looking
for examples :) The few examples I've seen online as to how to use this
have the FP whitespace-stripped, so I assumed it was done so deliberately
to work around that, and I did the same.
Whether TXT or CERT, though, it's a fairly high barrier for many users.
True, and sadly, applying for a separate typecode would be an additional
barrier to entry there. (SPF made TXT what it is today!) Is there a
formal spec document? The most I could find was a PDF slideshow.
I do encourage you to document it better, and I'm willing to help explain
wherever necessary, or make code changes if there is something that could be
done better.
Docs, I'm totally on. I'm trying as much as I can to link to the
standards docs as well, which is why I was asking for a
supported-uri-format doc.
Ideally there should be something in the gpg faq, something in the
manpage, and at least a small README in tools that covers all the things
in there (maybe we can talk about what the rest of those do as well).
If you really feel up to making code changes:
gpg --export --format cert-PGP d...@prime.gushi.org
gpg --export --format cert-IPGP gu...@gushi.org [--url=http://foo]
gpg --export --format pka f...@bar.com --url=http://foo
Some variation on the above would all be wonderful, but I don't think I'm
likely to get that wish granted.
One of the tutorials I saw made reference of using pgp-clean -- what is
the gnupg equivalent of this?
If you build GnuPG with curl (which is the default, assuming you have curl),
then you have HTTP 1.1 support. That said, is there a particular HTTP 1.1
feature that you need here? After the PKA parsing happens, GPG is just doing
a regular HTTP GET.
No, I'm just looking for a full list of what you can put in the uri=
portion of a _pka record. I never found it enumerated. Is https
supported? If so, does the system do cert validation? I've seen finger
and http, but wouldn't know where in the code to try to read to figure out
the full list.
I also didn't find a clear listing of what format the key should be in,
although the finger "hinted" at the usual armored format. From a code
end, I'd like to know for sure if either/both work.
4) Try though I might, I can't seem to get my full-key in CERT format to
recognize.
It works fine for me. What version of GPG are you using?
gpg (GnuPG) 2.0.12
libgcrypt 1.4.4
When you say it works for you, do you mean you're able to parse my key, or
that you've been able to publish and retrieve your own CERT-PGP record?
If I nuke things down to my single cert-ipgp record, could you try again?
Incidentally, you have two different CERT records for gushi.gushi.org at the
same time. You have both a fingerprint-style answer and a full-key answer.
This is not a major problem (GPG won't care - it'll just take the first one
that parses), but if your nameserver does some sort of round-robining, it can
be confusing as to which record is the one that gets used.
I did that because it complained about having "no fingerprint", so I
thought for a moment it needed both kinds, one with the key, and a
separate one with the FP.
Most versions of bind9 understand the CERT record, with base64
representation, and numeric typecodes. bind9.6 understands the PGP type
value mnemonic but not IPGP. BIND 9.7 understands IPGP.
The cert is a single, long, unbroken hex string. BIND will understand it
if you chuck it into an include file or paste it in with a non-wrapping
editor. But it's fragile and unwieldly.
If you feel like carefully counting characters, you can wrap it, as long
as you hit a hex boundary. Adding a few spaces and parens would make it
just work if wrapped. And the presentation format should be base64, not
binary (dnssec-signzone will convert both _pka and CERT records to this
format anyway).
When I wrote the code, precious few nameservers understood any of this (and
none understood IPGP at all - that patch only went into BIND a few months
ago).
Per one of the BIND developers, cert has been supported for 10 years,
typeXX for 7, although you probably would have had to use numeric algo
id's.
That's why the record is TYPE37 and not CERT. It's ugly, but it was
the least common denominator. It has been a few years since then. Possibly
it's time to upgrade.
I think so. I'm in favor of keeping the algotype numeric, but using the
CERT record, properly encoded. For most DNS folks, the \# notation is
confusing: it looks like an escaped comment.
-Dan
--
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
