Skip to content

Specify allowed encryption schemes #214

@technion

Description

@technion

Is your feature request related to a problem? Please describe.
The text regarding the encryption key states:

This field indicates an encryption key that security researchers should use for encrypted communication. Keys MUST NOT appear in this field - instead the value of this field MUST be a URI pointing to a location where the key can be retrieved. If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of {{!RFC7230}}).

There are examples utilising OpenPGP, however it is not described if other forms of encryption are allowed. OpenPGP is specifically RECOMMENDED in section 3.3 however that only applies to signing the file itself.

Describe the solution you'd like
I believe acceptable keys should be clarified. Posting a key for a proprietary product for example would defeat the purpose of this open standard.
I further suggest those acceptable formats should include the new (https://github.com/FiloSottile/age)[Age]. Aside from offering a modern encryption solution, the small key sizes may introduce the option of including the entire encryption key right there on the encryption line. Example for myself:

Encryption: age public key: age16nwklgjs6mdagl7w7pa5898urtkay68mkrgzhnstaacgtr4ldcrqzssru7

Note Age does not do signing and this suggestion does not need to impact section 3.3.

Describe alternatives you've considered
Limiting to OpenPGP would be the alternative.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions