Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove PKA support. #16

Merged
merged 1 commit into from
Dec 2, 2017
Merged

Remove PKA support. #16

merged 1 commit into from
Dec 2, 2017

Conversation

lambdafu
Copy link
Collaborator

@lambdafu lambdafu commented Dec 2, 2017

PKA is a proposal for automatic public key retrieval over DNS by Werner Koch. These seem to be the authoritative documents:

I am removing the support for this proposal from NeoPG:

  • There is very little adoption. Checking 642 email addresses from Debian maintainers shows only 8 PKA entries (and 22 TXT entries that are not PKA). Of these 8, several are expired keys (including the one from Simon Josefsson) or the URL is not reachable.
  • There is no standard or draft of a standard, or other process towards standardization.
  • All arguments against key retrieval via DNS apply (web bugs, lack of security in DNS, lack of control over DNS by users, difficulty of setting up DNS records, etc).
  • There are standardized alternatives (DANE RFC7929, CERT RFC4398)

In the future, NeoPG will provide an API to extend key retrieval and trust evaluation, allowing such experimental protocols to be included in applications without tainting the core code base.

@lambdafu lambdafu merged commit 6637863 into master Dec 2, 2017
@lambdafu lambdafu deleted the no-pka branch December 2, 2017 02:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant