blog/archive/2014/09/09.rss

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
   3         <channel>
   4                 <title>Petter Reinholdtsen - Entries from September 2014</title>
   5                 <description>Entries from September 2014</description>
   6                 <link>http://people.skolelinux.org/pere/blog/</link>
   7
   8
   9         <item>
  10                 <title>Good bye subkeys.pgp.net, welcome pool.sks-keyservers.net</title>
  11                 <link>http://people.skolelinux.org/pere/blog/Good_bye_subkeys_pgp_net__welcome_pool_sks_keyservers_net.html</link>
  12                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Good_bye_subkeys_pgp_net__welcome_pool_sks_keyservers_net.html</guid>
  13                 <pubDate>Wed, 10 Sep 2014 13:10:00 +0200</pubDate>
  14                 <description>&lt;p&gt;Yesterday, I had the pleasure of attending a talk with the
  15 &lt;a href=&quot;http://www.nuug.no/&quot;&gt;Norwegian Unix User Group&lt;/a&gt; about
  16 &lt;a href=&quot;http://www.nuug.no/aktiviteter/20140909-sks-keyservers/&quot;&gt;the
  17 OpenPGP keyserver pool sks-keyservers.net&lt;/a&gt;, and was very happy to
  18 learn that there is a large set of publicly available key servers to
  19 use when looking for peoples public key.  So far I have used
  20 subkeys.pgp.net, and some times wwwkeys.nl.pgp.net when the former
  21 were misbehaving, but those days are ended.  The servers I have used
  22 up until yesterday have been slow and some times unavailable.  I hope
  23 those problems are gone now.&lt;/p&gt;
  24
  25 &lt;p&gt;Behind the round robin DNS entry of the
  26 &lt;a href=&quot;https://sks-keyservers.net/&quot;&gt;sks-keyservers.net&lt;/a&gt; service
  27 there is a pool of more than 100 keyservers which are checked every
  28 day to ensure they are well connected and up to date.  It must be
  29 better than what I have used so far. :)&lt;/p&gt;
  30
  31 &lt;p&gt;Yesterdays speaker told me that the service is the default
  32 keyserver provided by the default configuration in GnuPG, but this do
  33 not seem to be used in Debian.  Perhaps it should?&lt;/p&gt;
  34
  35 &lt;p&gt;Anyway, I&#39;ve updated my ~/.gnupg/options file to now include this
  36 line:&lt;/p&gt;
  37
  38 &lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
  39 keyserver pool.sks-keyservers.net
  40 &lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;
  41
  42 &lt;p&gt;With GnuPG version 2 one can also locate the keyserver using SRV
  43 entries in DNS.  Just for fun, I did just that at work, so now every
  44 user of GnuPG at the University of Oslo should find a OpenGPG
  45 keyserver automatically should their need it:&lt;/p&gt;
  46
  47 &lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
  48 % host -t srv _pgpkey-http._tcp.uio.no
  49 _pgpkey-http._tcp.uio.no has SRV record 0 100 11371 pool.sks-keyservers.net.
  50 %
  51 &lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;
  52
  53 &lt;p&gt;Now if only
  54 &lt;a href=&quot;http://ietfreport.isoc.org/idref/draft-shaw-openpgp-hkp/&quot;&gt;the
  55 HKP lookup protocol&lt;/a&gt; supported finding signature paths, I would be
  56 very happy.  It can look up a given key or search for a user ID, but I
  57 normally do not want that, but to find a trust path from my key to
  58 another key.  Given a user ID or key ID, I would like to find (and
  59 download) the keys representing a signature path from my key to the
  60 key in question, to be able to get a trust path between the two keys.
  61 This is as far as I can tell not possible today.  Perhaps something
  62 for a future version of the protocol?&lt;/p&gt;
  63 </description>
  64         </item>
  65
  66         </channel>
  67 </rss>