[Freedombox-discuss] Software as Data, Transformation as a Service

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/01/13 17:53, Daniel Kahn Gillmor wrote:
> There is a (rough) openpgp2x509 perl script in the monkeysphere 
> msva-perl git repo (not yet released as part of the msva-perl 
> distribution).  I'd be happy to answer questions about it, and do
> get feedback, suggestions, complaints, patches, etc.

Hi Daniel,

Does the openpgp2x509 script use the NullSignatureUseOpenPGP signature
type you described in an earlier email?

https://lists.riseup.net/www/arc/monkeysphere/2011-03/msg00027.html

My concern with that approach is that the sigature type is sent in
plaintext during the handshake, making it simple to identify/block
OpenPGP-authenticated connections.

But I have to admit that I can't think of a way for the endpoints to
signal to each other that OpenPGP keys should be used to authenticate
the connection, without signalling the same to an eavesdropper. Any
thoughts?

Cheers,
Michael

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJQ7ZFCAAoJEBEET9GfxSfMUEIH/jkfecIFzQU/3p/hKO7cz1kB
o0nM3kCm9wLFRM1yH01scbispcUqGgHSmJTrdCRNKgq11PtWVUlAl5l5Ilzy71m3
s2TghVj0v1W/pGGrikKMsK5cLx0vRhtBQ09bGmBXI7MPtV7eSbPZr7otTa7q04pC
LxoEgu4u6B+bCOMNPBmrqNq6oLEfJZ7o9DieOBDMdjxMbqakleOKrGSNQhfFTvZp
n3UaR8MVvVhntCX1JwQVTlZOWQGboglmOUAoofjPjPXktPjVx361N6ptGofNXPU5
+99wuHmCf6aUnxHRx7QbhUkNrwstzaj76ajnfBYpt7cGJG9tU8ywAk96EM9hVg8=
=h0w9
-----END PGP SIGNATURE-----