| < draft-ietf-dane-openpgpkey-06.txt | draft-ietf-dane-openpgpkey-07.txt > | |||
|---|---|---|---|---|
| Network Working Group P. Wouters | Network Working Group P. Wouters | |||
| Internet-Draft Red Hat | Internet-Draft Red Hat | |||
| Intended status: Experimental October 20, 2015 | Intended status: Experimental January 27, 2016 | |||
| Expires: April 22, 2016 | Expires: July 30, 2016 | |||
| Using DANE to Associate OpenPGP public keys with email addresses | Using DANE to Associate OpenPGP public keys with email addresses | |||
| draft-ietf-dane-openpgpkey-06 | draft-ietf-dane-openpgpkey-07 | |||
| Abstract | Abstract | |||
| OpenPGP is a message format for email (and file) encryption that | OpenPGP is a message format for email (and file) encryption that | |||
| lacks a standardized lookup mechanism to securely obtain OpenPGP | lacks a standardized lookup mechanism to securely obtain OpenPGP | |||
| public keys. This document specifies a method for publishing and | public keys. DNS-Based Authentication of Named Entities ("DANE") is | |||
| locating OpenPGP public keys in DNS for a specific email address | a method for publishing public keys in DNS. This document specifies | |||
| using a new OPENPGPKEY DNS Resource Record. Security is provided via | a DANE method for publishing and locating OpenPGP public keys in DNS | |||
| Secure DNS, however the OPENPGPKEY record is not a replacement for | for a specific email address using a new OPENPGPKEY DNS Resource | |||
| verification of authenticity via the "Web of Trust" or manual | Record. Security is provided via Secure DNS, however the OPENPGPKEY | |||
| verification. The OPENPGPKEY record can be used to encrypt an email | record is not a replacement for verification of authenticity via the | |||
| that would otherwise have to be send unencrypted. | "Web of Trust" or manual verification. The OPENPGPKEY record can be | |||
| used to encrypt an email that would otherwise have to be send | ||||
| unencrypted. | ||||
| Status of This Memo | Status of This Memo | |||
| This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
| provisions of BCP 78 and BCP 79. | provisions of BCP 78 and BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
| working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
| Drafts is at http://datatracker.ietf.org/drafts/current/. | Drafts is at http://datatracker.ietf.org/drafts/current/. | |||
| Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| This Internet-Draft will expire on April 22, 2016. | This Internet-Draft will expire on July 30, 2016. | |||
| Copyright Notice | Copyright Notice | |||
| Copyright (c) 2015 IETF Trust and the persons identified as the | Copyright (c) 2016 IETF Trust and the persons identified as the | |||
| document authors. All rights reserved. | document authors. All rights reserved. | |||
| This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
| Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
| (http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
| publication of this document. Please review these documents | publication of this document. Please review these documents | |||
| carefully, as they describe your rights and restrictions with respect | carefully, as they describe your rights and restrictions with respect | |||
| to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
| include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
| the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
| described in the Simplified BSD License. | described in the Simplified BSD License. | |||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
| 1.1. Experiment goal . . . . . . . . . . . . . . . . . . . . . 3 | 1.1. Experiment goal . . . . . . . . . . . . . . . . . . . . . 3 | |||
| 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 | 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 2. The OPENPGPKEY Resource Record . . . . . . . . . . . . . . . 4 | 2. The OPENPGPKEY Resource Record . . . . . . . . . . . . . . . 4 | |||
| 2.1. The OPENPGPKEY RDATA component . . . . . . . . . . . . . 4 | 2.1. The OPENPGPKEY RDATA component . . . . . . . . . . . . . 4 | |||
| 2.1.1. The OPENPGPKEY RDATA content . . . . . . . . . . . . 5 | 2.1.1. The OPENPGPKEY RDATA content . . . . . . . . . . . . 4 | |||
| 2.1.2. Reducing the Transferable Public Key size . . . . . . 5 | 2.1.2. Reducing the Transferable Public Key size . . . . . . 5 | |||
| 2.2. The OPENPGPKEY RDATA wire format . . . . . . . . . . . . 6 | 2.2. The OPENPGPKEY RDATA wire format . . . . . . . . . . . . 6 | |||
| 2.3. The OPENPGPKEY RDATA presentation format . . . . . . . . 6 | 2.3. The OPENPGPKEY RDATA presentation format . . . . . . . . 6 | |||
| 3. Location of the OPENPGPKEY record . . . . . . . . . . . . . . 6 | 3. Location of the OPENPGPKEY record . . . . . . . . . . . . . . 6 | |||
| 4. Email address variants . . . . . . . . . . . . . . . . . . . 7 | 4. Email address variants . . . . . . . . . . . . . . . . . . . 7 | |||
| 5. Application use of OPENPGPKEY . . . . . . . . . . . . . . . . 7 | 5. Application use of OPENPGPKEY . . . . . . . . . . . . . . . . 7 | |||
| 5.1. Obtaining an OpenPGP key for a specific email address . . 8 | 5.1. Obtaining an OpenPGP key for a specific email address . . 7 | |||
| 5.2. Confirming the validity of an OpenPGP key . . . . . . . . 8 | 5.2. Confirming that an OpenPGP key is current . . . . . . . . 8 | |||
| 5.3. Public Key UIDs and query names . . . . . . . . . . . . . 8 | 5.3. Public Key UIDs and query names . . . . . . . . . . . . . 8 | |||
| 6. OpenPGP Key size and DNS . . . . . . . . . . . . . . . . . . 9 | 6. OpenPGP Key size and DNS . . . . . . . . . . . . . . . . . . 9 | |||
| 7. Security Considerations . . . . . . . . . . . . . . . . . . . 9 | 7. Security Considerations . . . . . . . . . . . . . . . . . . . 9 | |||
| 7.1. MTA behaviour . . . . . . . . . . . . . . . . . . . . . . 10 | 7.1. MTA behaviour . . . . . . . . . . . . . . . . . . . . . . 10 | |||
| 7.2. MUA behaviour . . . . . . . . . . . . . . . . . . . . . . 11 | 7.2. MUA behaviour . . . . . . . . . . . . . . . . . . . . . . 10 | |||
| 7.3. Email client behaviour . . . . . . . . . . . . . . . . . 11 | 7.3. Email client behaviour . . . . . . . . . . . . . . . . . 11 | |||
| 7.4. Response size . . . . . . . . . . . . . . . . . . . . . . 11 | 7.4. Response size . . . . . . . . . . . . . . . . . . . . . . 11 | |||
| 7.5. Email address information leak . . . . . . . . . . . . . 11 | 7.5. Email address information leak . . . . . . . . . . . . . 11 | |||
| 7.6. Storage of OPENPGPKEY data . . . . . . . . . . . . . . . 12 | 7.6. Storage of OPENPGPKEY data . . . . . . . . . . . . . . . 12 | |||
| 7.7. Security of OpenPGP versus DNSSEC . . . . . . . . . . . . 12 | 7.7. Security of OpenPGP versus DNSSEC . . . . . . . . . . . . 12 | |||
| 8. Implementation Status . . . . . . . . . . . . . . . . . . . . 12 | 8. Implementation Status . . . . . . . . . . . . . . . . . . . . 12 | |||
| 8.1. The GNU Privacy Guard (GNUpg) . . . . . . . . . . . . . . 13 | 8.1. The GNU Privacy Guard (GNUpg) . . . . . . . . . . . . . . 13 | |||
| 8.2. hash-slinger . . . . . . . . . . . . . . . . . . . . . . 14 | 8.2. hash-slinger . . . . . . . . . . . . . . . . . . . . . . 13 | |||
| 8.3. openpgpkey-milter . . . . . . . . . . . . . . . . . . . . 14 | 8.3. openpgpkey-milter . . . . . . . . . . . . . . . . . . . . 14 | |||
| 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 | 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14 | |||
| 9.1. OPENPGPKEY RRtype . . . . . . . . . . . . . . . . . . . . 15 | 9.1. OPENPGPKEY RRtype . . . . . . . . . . . . . . . . . . . . 14 | |||
| 10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 15 | 10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 15 | |||
| 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 15 | 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 15 | |||
| 11.1. Normative References . . . . . . . . . . . . . . . . . . 15 | 11.1. Normative References . . . . . . . . . . . . . . . . . . 15 | |||
| 11.2. Informative References . . . . . . . . . . . . . . . . . 16 | 11.2. Informative References . . . . . . . . . . . . . . . . . 16 | |||
| Appendix A. Generating OPENPGPKEY records . . . . . . . . . . . 17 | Appendix A. Generating OPENPGPKEY records . . . . . . . . . . . 17 | |||
| Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 18 | Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 18 | |||
| 1. Introduction | 1. Introduction | |||
| OpenPGP [RFC4880] public keys are used to encrypt or sign email | OpenPGP [RFC4880] public keys are used to encrypt or sign email | |||
| messages and files. To encrypt an email message, or verify a | messages and files. To encrypt an email message, or verify a | |||
| sender's OpenPGP signature, the email client or MTA needs to locate | sender's OpenPGP signature, the email client or MTA needs to locate | |||
| the recipient's OpenPGP public key. | the recipient's OpenPGP public key. | |||
| OpenPGP clients have relied on centralized "well-known" key servers | OpenPGP clients have relied on centralized "well-known" key servers | |||
| that are accessed using either the HTTP Keyserver Protocol [HKP] | that are accessed using either the HTTP Keyserver Protocol [HKP] | |||
| Alternatively, users need to manually browse a variety of different | Alternatively, users need to manually browse a variety of different | |||
| front-end websites. These key servers do not validate the email | front-end websites. These key servers do not require a confirmation | |||
| address in the User ID of the uploaded OpenPGP public key. Attackers | of the email address used in the User ID of the uploaded OpenPGP | |||
| can - and have - uploaded rogue public keys with other people's email | public key. Attackers can - and have - uploaded rogue public keys | |||
| addresses to these key servers. | with other people's email addresses to these key servers. | |||
| Once uploaded, public keys cannot be deleted. People who did not | Once uploaded, public keys cannot be deleted. People who did not | |||
| pre-sign a key revocation can never remove their OpenPGP public key | pre-sign a key revocation can never remove their OpenPGP public key | |||
| from these key servers once they have lost access to their private | from these key servers once they have lost access to their private | |||
| key. This results in receiving encrypted email that cannot be | key. This results in receiving encrypted email that cannot be | |||
| decrypted. | decrypted. | |||
| Therefor, these keyservers are not well suited to support email | Therefor, these keyservers are not well suited to support email | |||
| clients and MTA's to automatically encrypt email - especially in the | clients and MTA's to automatically encrypt email - especially in the | |||
| absence of an interactive user. | absence of an interactive user. | |||
| This document describes a mechanism to associate a user's OpenPGP | This document describes a mechanism to associate a user's OpenPGP | |||
| public key with their email address, using the OPENPGPKEY DNS RRtype. | public key with their email address, using the OPENPGPKEY DNS RRtype. | |||
| These records are published in the DNS zone of the user's email | These records are published in the DNS zone of the user's email | |||
| address. If the user loses their private key, the OPENPGPKEY DNS | address. If the user loses their private key, the OPENPGPKEY DNS | |||
| record can simply be updated or removed from the zone. | record can simply be updated or removed from the zone. | |||
| The OPENPGPKEY data is secured using Secure DNS. | The OPENPGPKEY data is secured using Secure DNS [RFC4035] | |||
| The main goal of the OPENPGPKEY resource record is to stop passive | The main goal of the OPENPGPKEY resource record is to stop passive | |||
| attacks against plaintext emails. While it can also twart some | attacks against plaintext emails. While it can also thwart some | |||
| active attacks (such as people uploading rogue keys to keyservers in | active attacks (such as people uploading rogue keys to keyservers in | |||
| the hopes that others will encrypt to these rogue keys), this | the hopes that others will encrypt to these rogue keys), this | |||
| resource record is not a replacement for verifying OpenPGP public | resource record is not a replacement for verifying OpenPGP public | |||
| keys via the web of trust signatures, or manually via a fingerprint | keys via the web of trust signatures, or manually via a fingerprint | |||
| verification. | verification. | |||
| 1.1. Experiment goal | 1.1. Experiment goal | |||
| This document defines an Experimental RRtype. The goal of the | This document defines an RRtype whose use is Experimental. The goal | |||
| experiment is to see whether encrypted email usage will increase if | of the experiment is to see whether encrypted email usage will | |||
| an automated discovery method is available to MTA's and MUA's to help | increase if an automated discovery method is available to MTA's and | |||
| the enduser with email encryption key management. | MUA's to help the enduser with email encryption key management. | |||
| It is unclear if this RRtype will scale to some of the larger email | It is unclear if this RRtype will scale to some of the larger email | |||
| service deployments. Concerns have been raised about the size of the | service deployments. Concerns have been raised about the size of the | |||
| OPENPGPKEY record and the size of the resulting DNS zone files. This | OPENPGPKEY record and the size of the resulting DNS zone files. This | |||
| experiment hopefully will give the working group some insight into | experiment hopefully will give the working group some insight into | |||
| whether this is a problem or not. | whether this is a problem or not. | |||
| If the experiment is successful, it is expected that the findings of | If the experiment is successful, it is expected that the findings of | |||
| the experiment will result in an updated document for standards track | the experiment will result in an updated document for standards track | |||
| approval. | approval. | |||
| The OPENPGPKEY RRtype somewhat resembles the generic CERT record | The OPENPGPKEY RRtype somewhat resembles the generic CERT record | |||
| defined in [RFC4398]. However, the CERT record uses sub-typing with | defined in [RFC4398]. However, the CERT record uses sub-typing with | |||
| many different types of keys and certificates. It is suspected that | many different types of keys and certificates. It is suspected that | |||
| its generality of very different protocols (PKIX versus OpenPGP) has | its general application of very different protocols (PKIX versus | |||
| been the cause for lack of implementation and deployment. | OpenPGP) has been the cause for lack of implementation and | |||
| Furthermore, the CERT record uses sub-typing, which is now considered | deployment. Furthermore, the CERT record uses sub-typing, which is | |||
| to be a bad idea for DNS. | now considered to be a bad idea for DNS. | |||
| 1.2. Terminology | 1.2. Terminology | |||
| The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
| "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | |||
| document are to be interpreted as described in RFC 2119 [RFC2119]. | document are to be interpreted as described in RFC 2119 [RFC2119]. | |||
| This document also makes use of standard DNSSEC and DANE terminology. | This document also makes use of standard DNSSEC and DANE terminology. | |||
| See DNSSEC [RFC4033], [RFC4034], [RFC4035], and DANE [RFC6698] for | See DNSSEC [RFC4033], [RFC4034], [RFC4035], and DANE [RFC6698] for | |||
| these terms. | these terms. | |||
| skipping to change at page 4, line 44 ¶ | skipping to change at page 4, line 41 ¶ | |||
| The OPENPGPKEY DNS resource record (RR) is used to associate an end | The OPENPGPKEY DNS resource record (RR) is used to associate an end | |||
| entity OpenPGP Transferable Public Key (see Section 11.1 of [RFC4880] | entity OpenPGP Transferable Public Key (see Section 11.1 of [RFC4880] | |||
| with an email address, thus forming a "OpenPGP public key | with an email address, thus forming a "OpenPGP public key | |||
| association". A user that wishes to specify more than one OpenPGP | association". A user that wishes to specify more than one OpenPGP | |||
| key, for example because they are transitioning to a newer stronger | key, for example because they are transitioning to a newer stronger | |||
| key, can do so by adding multiple OPENPGPKEY records. A single | key, can do so by adding multiple OPENPGPKEY records. A single | |||
| OPENPGPKEY DNS record MUST only contain one OpenPGP key. | OPENPGPKEY DNS record MUST only contain one OpenPGP key. | |||
| The type value allocated for the OPENPGPKEY RR type is 61. The | The type value allocated for the OPENPGPKEY RR type is 61. The | |||
| OPENPGPKEY RR is class independent. The OPENPGPKEY RR has no special | OPENPGPKEY RR is class independent. | |||
| TTL requirements. | ||||
| 2.1. The OPENPGPKEY RDATA component | 2.1. The OPENPGPKEY RDATA component | |||
| The RDATA portion of an OPENPGPKEY Resource Record contains a single | The RDATA portion of an OPENPGPKEY Resource Record contains a single | |||
| value consisting of a [RFC4880] formatted Transferable Public Key. | value consisting of a [RFC4880] formatted Transferable Public Key. | |||
| 2.1.1. The OPENPGPKEY RDATA content | 2.1.1. The OPENPGPKEY RDATA content | |||
| An OpenPGP Transferable Public Key can be arbitrarily large. DNS | An OpenPGP Transferable Public Key can be arbitrarily large. DNS | |||
| records are limited in size. When creating OPENPGPKEY DNS records, | records are limited in size. When creating OPENPGPKEY DNS records, | |||
| skipping to change at page 6, line 36 ¶ | skipping to change at page 6, line 29 ¶ | |||
| Public Key. | Public Key. | |||
| 2.2. The OPENPGPKEY RDATA wire format | 2.2. The OPENPGPKEY RDATA wire format | |||
| The RDATA Wire Format consists of a single OpenPGP Transferable | The RDATA Wire Format consists of a single OpenPGP Transferable | |||
| Public Key as defined in Section 11.1 of [RFC4880]. Note that this | Public Key as defined in Section 11.1 of [RFC4880]. Note that this | |||
| format is without ASCII armor or base64 encoding. | format is without ASCII armor or base64 encoding. | |||
| 2.3. The OPENPGPKEY RDATA presentation format | 2.3. The OPENPGPKEY RDATA presentation format | |||
| The RDATA Presentation Format, as visible in textual zone files, | The RDATA Presentation Format, as visible in master files [RFC1035], | |||
| consists of a single OpenPGP Transferable Public Key as defined in | consists of a single OpenPGP Transferable Public Key as defined in | |||
| Section 11.1 of [RFC4880] encoded in base64 as defined in Section 4 | Section 11.1 of [RFC4880] encoded in base64 as defined in Section 4 | |||
| of [RFC4648]. | of [RFC4648]. | |||
| 3. Location of the OPENPGPKEY record | 3. Location of the OPENPGPKEY record | |||
| The DNS does not allow the use of all characters that are supported | The DNS does not allow the use of all characters that are supported | |||
| in the "local-part" of email addresses as defined in [RFC5322] and | in the "local-part" of email addresses as defined in [RFC5322] and | |||
| [RFC6530]. Therefore, email addresses are mapped into DNS using the | [RFC6530]. Therefore, email addresses are mapped into DNS using the | |||
| following method: | following method: | |||
| o The user name (the "left-hand side" of the email address, called | o The user name (the "left-hand side" of the email address, called | |||
| the "local-part" in the mail message format definition [RFC5322] | the "local-part" in the mail message format definition [RFC5322] | |||
| and the local-part in the specification for internationalized | and the local-part in the specification for internationalized | |||
| email [RFC6530]) should already be encoded in UTF-8 (or its subset | email [RFC6530]) is encoded in UTF-8 (or its subset ASCII). If | |||
| ASCII). If it is written in another encoding it should be | the local-part is written in another encoding it MUST be converted | |||
| converted to UTF-8 and then hashed using the SHA2-256 [RFC5754] | to UTF-8. | |||
| algorithm, with the hash truncated to 28 octets and represented in | ||||
| its hexadecimal representation, to become the left-most label in | o The local-part is hashed using the SHA2-256 [RFC5754] algorithm, | |||
| the prepared domain name. Truncation comes from the right-most | with the hash truncated to 28 octets and represented in its | |||
| octets. This does not include the at symbol ("@") that separates | hexadecimal representation, to become the left-most label in the | |||
| the left and right sides of the email address. | prepared domain name. | |||
| o The string "_openpgpkey" becomes the second left-most label in the | o The string "_openpgpkey" becomes the second left-most label in the | |||
| prepared domain name. | prepared domain name. | |||
| o The domain name (the "right-hand side" of the email address, | o The domain name (the "right-hand side" of the email address, | |||
| called the "domain" in RFC 5322) is appended to the result of step | called the "domain" in [RFC5322]) is appended to the result of | |||
| 2 to complete the prepared domain name. | step 2 to complete the prepared domain name. | |||
| For example, to request an OPENPGPKEY resource record for a user | For example, to request an OPENPGPKEY resource record for a user | |||
| whose email address is "hugh@example.com", an OPENPGPKEY query would | whose email address is "hugh@example.com", an OPENPGPKEY query would | |||
| be placed for the following QNAME: "c93f1e400f26708f98cb19d936620da35 | be placed for the following QNAME: "c93f1e400f26708f98cb19d936620da35 | |||
| eec8f72e57f9eec01c1afd6._openpgpkey.example.com". The corresponding | eec8f72e57f9eec01c1afd6._openpgpkey.example.com". The corresponding | |||
| RR in the example.com zone might look like (key shortened for | RR in the example.com zone might look like (key shortened for | |||
| formatting): | formatting): | |||
| c9[..]d6._openpgpkey.example.com. IN OPENPGPKEY <base64 public key> | c9[..]d6._openpgpkey.example.com. IN OPENPGPKEY <base64 public key> | |||
| skipping to change at page 7, line 47 ¶ | skipping to change at page 7, line 41 ¶ | |||
| OPENPGPKEY record associated with the dynamically created email | OPENPGPKEY record associated with the dynamically created email | |||
| address. | address. | |||
| [RFC5321] and its predecessors have always made it clear that only | [RFC5321] and its predecessors have always made it clear that only | |||
| the recipient MTA is allowed to interpret the local-part of an | the recipient MTA is allowed to interpret the local-part of an | |||
| address. A client supporting OPENPGPKEY therefor MUST NOT perform | address. A client supporting OPENPGPKEY therefor MUST NOT perform | |||
| any kind of mapping rules based on the email address. | any kind of mapping rules based on the email address. | |||
| 5. Application use of OPENPGPKEY | 5. Application use of OPENPGPKEY | |||
| The OPENPGPKEY record allows an application or service to obtain or | The OPENPGPKEY record allows an application or service to obtain an | |||
| verify an OpenPGP public key. The lookup result MUST pass DNSSEC | OpenPGP public key and use it for verifying a digital signature or | |||
| validation; if validation reaches any state other than "Secure", the | encrypting a message to the public key. The DNS answer MUST pass | |||
| verification MUST be treated as a failure. | DNSSEC validation; if DNSSEC validation reaches any state other than | |||
| "Secure" (as specified in [RFC4035]), the DNSSEC validation MUST be | ||||
| treated as a failure. | ||||
| 5.1. Obtaining an OpenPGP key for a specific email address | 5.1. Obtaining an OpenPGP key for a specific email address | |||
| If no OpenPGP public keys are known for an email address, an | If no OpenPGP public keys are known for an email address, an | |||
| OPENPGPKEY lookup MAY be performed to discover the OpenPGP public key | OPENPGPKEY DNS lookup MAY be performed to seek the OpenPGP public key | |||
| that belongs to a specific email address. This public key can then | that corresponds to that email address. This public key can then be | |||
| be used to verify a received signed message or can be used to send | used to verify a received signed message or can be used to send out | |||
| out an encrypted email message. An application that confirms the | an encrypted email message. An application whose attempt fails to | |||
| lack of an OPENPGPKEY record SHOULD remember this for some time to | retrieve a DNSSEC verified OPENPGPKEY RR from the DNS should remember | |||
| avoid sending out a DNS request for each email message that is sent | that failure for some time to avoid sending out a DNS request for | |||
| out as this constitutes a privacy leak. | each email message the application is sending out; such DNS requests | |||
| constitute a privacy leak | ||||
| 5.2. Confirming the validity of an OpenPGP key | 5.2. Confirming that an OpenPGP key is current | |||
| Locally stored OpenPGP public keys are not automatically refreshed. | Locally stored OpenPGP public keys are not automatically refreshed. | |||
| If the owner of that key creates a new OpenPGP public key, that owner | If the owner of that key creates a new OpenPGP public key, that owner | |||
| is unable to securely notify all users and applications that have its | is unable to securely notify all users and applications that have its | |||
| old OpenPGP public key. Applications and users can perform an | old OpenPGP public key. Applications and users can perform an | |||
| OPENPGPKEY lookup to confirm the locally stored OpenPGP public key is | OPENPGPKEY lookup to confirm the locally stored OpenPGP public key is | |||
| still the correct key to use. If verifying a locally stored OpenPGP | still the correct key to use. If the locally stored OpenPGP public | |||
| public key and the OpenPGP public key found through DNS is different | key is different from the DNSSEC validated OpenPGP public key | |||
| from the locally stored OpenPGP public key, the verification MUST be | currently published in DNS, the verification MUST be treated as a | |||
| treated as a failure. An application that can interact with the user | failure unless the locally stored OpenPGP key signed the newly | |||
| MAY ask the user for guidance. For privacy reasons, an application | published OpenPGP public key found in DNS. An application that can | |||
| MUST NOT attempt to validate a locally stored OpenPGP key using an | interact with the user MAY ask the user for guidance. For privacy | |||
| OPENPGPKEY lookup at every use of that key. | reasons, an application MUST NOT attempt to lookup an OpenPGP key | |||
| from DNSSEC at every use of that key. | ||||
| 5.3. Public Key UIDs and query names | 5.3. Public Key UIDs and query names | |||
| An OpenPGP public key can be associated with multiple email addresses | An OpenPGP public key can be associated with multiple email addresses | |||
| by specifying multiple key uids. The OpenPGP public key obtained | by specifying multiple key uids. The OpenPGP public key obtained | |||
| from a OPENPGPKEY RR can be used as long as the query and resulting | from a OPENPGPKEY RR can be used as long as the query and resulting | |||
| data form a proper email to uid identity association. | data form a proper email to uid identity association. | |||
| CNAME's (see [RFC2181]) and DNAME's (see [RFC6672]) can be followed | CNAME's (see [RFC2181]) and DNAME's (see [RFC6672]) can be followed | |||
| to obtain an OPENPGPKEY RR, as long as the original recipient's email | to obtain an OPENPGPKEY RR, as long as the original recipient's email | |||
| skipping to change at page 9, line 4 ¶ | skipping to change at page 8, line 50 ¶ | |||
| 8d57[...]b7._openpgpkey.example.net, and an OPENPGPKEY RR for | 8d57[...]b7._openpgpkey.example.net, and an OPENPGPKEY RR for | |||
| 8d57[...]b7._openpgpkey.example.net exists, then this OpenPGP public | 8d57[...]b7._openpgpkey.example.net exists, then this OpenPGP public | |||
| key can be used, provided one of the key uids contains | key can be used, provided one of the key uids contains | |||
| "hugh@example.com". This public key cannot be used if it would only | "hugh@example.com". This public key cannot be used if it would only | |||
| contain the key uid "hugh@example.net". | contain the key uid "hugh@example.net". | |||
| If one of the OpenPGP key uids contains only a single wildcard as the | If one of the OpenPGP key uids contains only a single wildcard as the | |||
| LHS of the email address, such as "*@example.com", the OpenPGP public | LHS of the email address, such as "*@example.com", the OpenPGP public | |||
| key may be used for any email address within that domain. Wildcards | key may be used for any email address within that domain. Wildcards | |||
| at other locations (eg hugh@*.com) or regular expressions in key uids | at other locations (eg hugh@*.com) or regular expressions in key uids | |||
| are not allowed, and any OPENPGPKEY RR containing these should be | are not allowed, and any OPENPGPKEY RR containing these MUST be | |||
| ignored. | ignored. | |||
| 6. OpenPGP Key size and DNS | 6. OpenPGP Key size and DNS | |||
| Due to the expected size of the OPENPGPKEY record, applications | Due to the expected size of the OPENPGPKEY record, applications | |||
| SHOULD use TCP - not UDP - to perform queries for the OPENPGPKEY | SHOULD use TCP - not UDP - to perform queries for the OPENPGPKEY | |||
| Resource Record. | Resource Record. | |||
| Although the reliability of the transport of large DNS Resource | Although the reliability of the transport of large DNS Resource | |||
| Records has improved in the last years, it is still recommended to | Records has improved in the last years, it is still recommended to | |||
| keep the DNS records as small as possible without sacrificing the | keep the DNS records as small as possible without sacrificing the | |||
| security properties of the public key. The algorithm type and key | security properties of the public key. The algorithm type and key | |||
| size of OpenPGP keys should not be modified to accommodate this | size of OpenPGP keys should not be modified to accommodate this | |||
| section. | section. | |||
| OpenPGP supports various attributes that do not contribute to the | OpenPGP supports various attributes that do not contribute to the | |||
| security of a key, such as an embedded image file. It is recommended | security of a key, such as an embedded image file. It is recommended | |||
| that these properties are not exported to OpenPGP public keyrings | that these properties not be exported to OpenPGP public keyrings that | |||
| that are used to create OPENPGPKEY Resource Records. Some OpenPGP | are used to create OPENPGPKEY Resource Records. Some OpenPGP | |||
| software, for example GnuPG, have support for a "minimal key export" | software, for example GnuPG, support a "minimal key export" that is | |||
| that is well suited to use as OPENPGPKEY RDATA. See Appendix A. | well suited to use as OPENPGPKEY RDATA. See Appendix A. | |||
| 7. Security Considerations | 7. Security Considerations | |||
| DNSSEC is not an alternative for the "web of trust" or for manual | DNSSEC is not an alternative for the "web of trust" or for manual | |||
| fingerprint verification by humans. It is a solution aimed to ease | fingerprint verification by users. DANE for OpenPGP as specified in | |||
| obtaining someone's public key, and without manual verification | this document is a solution aimed to ease obtaining someone's public | |||
| should be treated as "better then plaintext" only. While this twarts | key. Without manual verification of the OpenPGP key obtained via | |||
| all passive attacks that simply capture and log all plaintext email | DANE, this retrieved key should only be used for encryption if the | |||
| content, it is not a security measure against active attacks. A user | only other alternative is sending the message in plaintext. While | |||
| who publishes an OPENPGPKEY record in DNS still expects senders to | this thwarts all passive attacks that simply capture and log all | |||
| perform their due diligence by additional verification of their | plaintext email content, it is not a security measure against active | |||
| public key via other out-of-band methods before sending any | attacks. A user who publishes an OPENPGPKEY record in DNS still | |||
| confidential or sensitive information. | expects senders to perform their due diligence by additional (non- | |||
| DNSSEC) verification of their public key via other out-of-band | ||||
| methods before sending any confidential or sensitive information. | ||||
| In other words, the OPENPGPKEY record MUST NOT be used to send | In other words, the OPENPGPKEY record MUST NOT be used to send | |||
| sensitive information without additional verification or confirmation | sensitive information without additional verification or confirmation | |||
| that the OpenPGP key actually belongs to the target recipient. | that the OpenPGP key actually belongs to the target recipient. | |||
| Various components could be responsible for encrypting an email | Various components could be responsible for encrypting an email | |||
| message to a target recipient. It could be done by the sender's | message to a target recipient. It could be done by the sender's | |||
| email client or software plugin, the sender's Mail User Agent (MUA) | email client or software plugin, the sender's Mail User Agent (MUA) | |||
| or the sender's Mail Transfer Agent (MTA). Each of these have their | or the sender's Mail Transfer Agent (MTA). Each of these have their | |||
| own characteristics. An email client can direct the human to make a | own characteristics. An email client can ask the user to make a | |||
| decision before continuing. The MUA can either accept or refuse a | decision before continuing. The MUA can either accept or refuse a | |||
| message. The MTA must deliver the message as-is, or encrypt the | message. The MTA must deliver the message as-is, or encrypt the | |||
| message before delivering. Each of these programs should attempt to | message before delivering. Each of these programs should attempt to | |||
| encrypt an unencrypted received message whenever possible. | encrypt an unencrypted received message whenever possible. | |||
| In theory, two different local-parts could hash to the same value. | ||||
| This document assumes that such a hash collision has a negliable | ||||
| chance of happening. | ||||
| Organisations that are required to be able to read everyone's | Organisations that are required to be able to read everyone's | |||
| encrypted email should publish the escrow key as the OPENPGPKEY | encrypted email should publish the escrow key as the OPENPGPKEY | |||
| record. Upon receipt, such mail servers MAY optionally re-encrypt | record. Mail servers of such organizations MAY optionally re-encrypt | |||
| the message to the individual's OpenPGP key. | the message to the individual's OpenPGP key. | |||
| 7.1. MTA behaviour | 7.1. MTA behaviour | |||
| An MTA could be operating in a stand-alone mode, without access to | An MTA could be operating in a stand-alone mode, without access to | |||
| the sender's OpenPGP public keyring, or in a way where it can access | the sender's OpenPGP public keyring, or in a way where it can access | |||
| the user's OpenPGP public keyring. Regardless, the MTA MUST NOT | the user's OpenPGP public keyring. Regardless, the MTA MUST NOT | |||
| modify the user's OpenPGP keyring. | modify the user's OpenPGP keyring. | |||
| An MTA sending an email MUST NOT add the public key obtained from an | An MTA sending an email MUST NOT add the public key obtained from an | |||
| skipping to change at page 10, line 39 ¶ | skipping to change at page 10, line 33 ¶ | |||
| use beyond the TTL. | use beyond the TTL. | |||
| If the obtained public key is revoked, the MTA MUST NOT use the key | If the obtained public key is revoked, the MTA MUST NOT use the key | |||
| for encryption, even if that would result in sending the message in | for encryption, even if that would result in sending the message in | |||
| plaintext. | plaintext. | |||
| If a message is already encrypted, the MTA SHOULD NOT re-encrypt the | If a message is already encrypted, the MTA SHOULD NOT re-encrypt the | |||
| message, even if different encryption schemes or different encryption | message, even if different encryption schemes or different encryption | |||
| keys would be used. | keys would be used. | |||
| If the DNS request for an OPENPGPKEY record returned an | If the DNS request for an OPENPGPKEY record returned an Indeterminate | |||
| "indeterminate" or "bogus" answer, the MTA MUST NOT sent the message | or Bogus answer as specified in [RFC4035], the MTA MUST NOT send the | |||
| and queue the plaintext message for encrypted delivery at a later | message and queue the plaintext message for encrypted delivery at a | |||
| time. If the problem persists, the email should be returned via the | later time. If the problem persists, the email should be returned | |||
| regular bounce methods. | via the regular bounce methods. | |||
| If multiple non-revoked OPENPGPKEY resource records are found, the | If multiple non-revoked OPENPGPKEY resource records are found, the | |||
| MTA SHOULD pick the most secure RR based on its local policy. | MTA SHOULD pick the most secure RR based on its local policy. | |||
| 7.2. MUA behaviour | 7.2. MUA behaviour | |||
| If the public key for a recipient obtained from the locally stored | If the public key for a recipient obtained from the locally stored | |||
| sender's public keyring differs from the recipient's OPENPGPKEY RR, | sender's public keyring differs from the recipient's OPENPGPKEY RR, | |||
| the MUA MUST NOT accept the message for delivery. | the MUA MUST NOT accept the message for delivery. | |||
| skipping to change at page 11, line 28 ¶ | skipping to change at page 11, line 17 ¶ | |||
| policy. | policy. | |||
| 7.3. Email client behaviour | 7.3. Email client behaviour | |||
| Email clients should adhere to the above listed MUA behaviour. | Email clients should adhere to the above listed MUA behaviour. | |||
| Additionally, an email client MAY interact with the user to resolve | Additionally, an email client MAY interact with the user to resolve | |||
| any conflicts between locally stored keyrings and OPENPGPKEY RRdata. | any conflicts between locally stored keyrings and OPENPGPKEY RRdata. | |||
| An email client that is encrypting a message SHOULD clearly indicate | An email client that is encrypting a message SHOULD clearly indicate | |||
| to the user the difference between encrypting to a locally stored and | to the user the difference between encrypting to a locally stored and | |||
| humanly verified public key and encrypting to an unverified (by the | user verified public key and encrypting to an unverified public key | |||
| human sender) public key obtained via an OPENPGPKEY resource record. | obtained via an OPENPGPKEY resource record. | |||
| 7.4. Response size | 7.4. Response size | |||
| To prevent amplification attacks, an Authoritative DNS server MAY | To prevent amplification attacks, an Authoritative DNS server MAY | |||
| wish to prevent returning OPENPGPKEY records over UDP unless the | wish to prevent returning OPENPGPKEY records over UDP unless the | |||
| source IP address has been verified with [EDNS-COOKIE]. Such servers | source IP address has been confirmed with [EDNS-COOKIE]. Such | |||
| MUST NOT return REFUSED, but answer the query with an empty Answer | servers MUST NOT return REFUSED, but answer the query with an empty | |||
| Section and the truncation flag set ("TC=1"). | Answer Section and the truncation flag set ("TC=1"). | |||
| 7.5. Email address information leak | 7.5. Email address information leak | |||
| The hashing of the user name in this document is not a security | The hashing of the user name in this document is not a security | |||
| feature. Publishing OPENPGPKEY records however, will create a list | feature. Publishing OPENPGPKEY records however, will create a list | |||
| of hashes of valid email addresses, which could simplify obtaining a | of hashes of valid email addresses, which could simplify obtaining a | |||
| list of valid email addresses for a particular domain. It is | list of valid email addresses for a particular domain. It is | |||
| desirable to not ease the harvesting of email addresses where | desirable to not ease the harvesting of email addresses where | |||
| possible. | possible. | |||
| skipping to change at page 12, line 44 ¶ | skipping to change at page 12, line 29 ¶ | |||
| to a particular user. | to a particular user. | |||
| 7.7. Security of OpenPGP versus DNSSEC | 7.7. Security of OpenPGP versus DNSSEC | |||
| Anyone who can obtain a DNSSEC private key of a domain name via | Anyone who can obtain a DNSSEC private key of a domain name via | |||
| coercion, theft or brute force calculations, can replace any | coercion, theft or brute force calculations, can replace any | |||
| OPENPGPKEY record in that zone and all of the delegated child zones. | OPENPGPKEY record in that zone and all of the delegated child zones. | |||
| Any future messages encrypted with the malicious OpenPGP key could | Any future messages encrypted with the malicious OpenPGP key could | |||
| then be read. | then be read. | |||
| Therefore, an OpenPGP key obtained via an OPENPGPKEY record can only | Therefore, an OpenPGP key obtained via a DNSSEC validated OPENPGPKEY | |||
| be trusted as much as the DNS domain can be trusted, and is no | record can only be trusted as much as the DNS domain can be trusted, | |||
| substitute for in-person key verification or verification via the | and is no substitute for in-person OpenPGP key verification or | |||
| "Web of Trust". | additional Openpgp verification via "Web of Trust" signatures present | |||
| on the OpenPGP in question. | ||||
| 8. Implementation Status | 8. Implementation Status | |||
| [RFC Editor Note: Please remove this entire seciton prior to | [RFC Editor Note: Please remove this entire seciton prior to | |||
| publication as an RFC.] | publication as an RFC.] | |||
| This section records the status of known implementations of the | This section records the status of known implementations of the | |||
| protocol defined by this specification at the time of posting of this | protocol defined by this specification at the time of posting of this | |||
| Internet-Draft, and is based on a proposal described in [RFC6982]. | Internet-Draft, and is based on a proposal described in [RFC6982]. | |||
| The description of implementations in this section is intended to | The description of implementations in this section is intended to | |||
| assist the IETF in its decision processes in progressing drafts to | assist the IETF in its decision processes in progressing drafts to | |||
| RFCs. Please note that the listing of any individual implementation | RFCs. Please note that the listing of any individual implementation | |||
| here does not imply endorsement by the IETF. Furthermore, no effort | here does not imply endorsement by the IETF. Furthermore, no effort | |||
| has been spent to verify the information presented here that was | has been spent to verify the information presented here that was | |||
| supplied by IETF contributors. This is not intended as, and must not | supplied by IETF contributors. This is not intended as, and must not | |||
| be construed to be, a catalog of available implementations or their | be construed to be, a catalog of available implementations or their | |||
| skipping to change at page 14, line 8 ¶ | skipping to change at page 13, line 41 ¶ | |||
| Implementation Experience: Currrent experience limited to small test | Implementation Experience: Currrent experience limited to small test | |||
| networks only | networks only | |||
| Contact Information: https://gnupg.org/ | Contact Information: https://gnupg.org/ | |||
| Interoperability: No report. | Interoperability: No report. | |||
| 8.2. hash-slinger | 8.2. hash-slinger | |||
| Implementation Name and Details: The hash-slinger software is a | Implementation Name and Details: The hash-slinger software is a | |||
| collection of tools to generate and verify application DNS records | collection of tools to generate, download and verify application | |||
| written by the author of this document. It is available at http:/ | public keys and application fingerprints. It uses DNSSEC | |||
| /people.redhat.com/pwouters/ | validation. The tool is written by the author of this document. | |||
| It is available at http://people.redhat.com/pwouters/ | ||||
| Brief Description: Support has been added in the form of an | Brief Description: Support has been added in the form of an | |||
| "openpgpkey" command that can generate, fetch and verify | "openpgpkey" command that can generate, fetch, validate the DNSSEC | |||
| OPENPGPKEY records. | authentication and verify OPENPGPKEY records. | |||
| Level of Maturity: The implementation has been around for a few | Level of Maturity: The implementation has been around for a few | |||
| months but has not seen widespread deployment. | months but has not seen widespread deployment. | |||
| Coverage: The implementation follows the latest draft with the | Coverage: The implementation follows the latest draft with the | |||
| exception that it first performs a lowercase of the local-part | exception that it first performs a lowercase of the local-part | |||
| before hashing. | before hashing. | |||
| Licensing: All code is covered under the GNU Public License version | Licensing: All code is covered under the GNU Public License version | |||
| 3 or later. | 3 or later. | |||
| skipping to change at page 15, line 18 ¶ | skipping to change at page 15, line 4 ¶ | |||
| Implementation Experience: Currrent experience limited to small test | Implementation Experience: Currrent experience limited to small test | |||
| networks only | networks only | |||
| Contact Information: pwouters@redhat.com | Contact Information: pwouters@redhat.com | |||
| Interoperability: No report. | Interoperability: No report. | |||
| 9. IANA Considerations | 9. IANA Considerations | |||
| 9.1. OPENPGPKEY RRtype | 9.1. OPENPGPKEY RRtype | |||
| This document uses a new DNS RR type, OPENPGPKEY, whose value 61 has | This document uses a new DNS RR type, OPENPGPKEY, whose value 61 has | |||
| been allocated by IANA from the Resource Record (RR) TYPEs | been allocated by IANA from the Resource Record (RR) TYPEs | |||
| subregistry of the Domain Name System (DNS) Parameters registry. | subregistry of the Domain Name System (DNS) Parameters registry. | |||
| 10. Acknowledgments | 10. Acknowledgments | |||
| This document is based on RFC-4255 and draft-ietf-dane-smime whose | This document is based on RFC-4255 and draft-ietf-dane-smime whose | |||
| authors are Paul Hoffman, Jacob Schlyter and W. Griffin. Olafur | authors are Paul Hoffman, Jacob Schlyter and W. Griffin. Olafur | |||
| Gudmundsson provided feedback and suggested various improvements. | Gudmundsson provided feedback and suggested various improvements. | |||
| Willem Toorop contributed the gpg and hexdump command options. | Willem Toorop contributed the gpg and hexdump command options. | |||
| Daniel Kahn Gillmor provided the text describing the OpenPGP packet | Daniel Kahn Gillmor provided the text describing the OpenPGP packet | |||
| formats and filtering options. Edwin Taylor contributed language | formats and filtering options. Edwin Taylor contributed language | |||
| improvements for various iterations of this document. Text regarding | improvements for various iterations of this document. Text regarding | |||
| email mappings was taken from draft-levine-dns-mailbox whose author | email mappings was taken from draft-levine-dns-mailbox whose author | |||
| is John Levine. | is John Levine. | |||
| 11. References | 11. References | |||
| 11.1. Normative References | 11.1. Normative References | |||
| [RFC1035] Mockapetris, P., "Domain names - implementation and | ||||
| specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, | ||||
| November 1987, <http://www.rfc-editor.org/info/rfc1035>. | ||||
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
| Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ | Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ | |||
| RFC2119, March 1997, | RFC2119, March 1997, | |||
| <http://www.rfc-editor.org/info/rfc2119>. | <http://www.rfc-editor.org/info/rfc2119>. | |||
| [RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS | [RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS | |||
| Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997, | Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997, | |||
| <http://www.rfc-editor.org/info/rfc2181>. | <http://www.rfc-editor.org/info/rfc2181>. | |||
| [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. | [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. | |||
| End of changes. 39 change blocks. | ||||
| 102 lines changed or deleted | 118 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||