reudnetz/website
Watch
9
1
Fork
You've already forked website
 3
Code Issues Pull requests 2 Releases Activity

add gnupg wdk (openpgp web key directory) [1] #12

Open
nzeo wants to merge 1 commit from nzeo/website:wdk into master
pull from: nzeo/website:wdk
merge into: reudnetz:master
Conversation 1 Commits 1 Files changed 3 +4
nzeo commented 2026-05-22 15:45:28 +02:00
Member
Copy link

this way users can import our gpg key via gnupg (gpg --locate-keys mail@reudnetz.org) and maybe in some modern mua's? well, we have to see if mua's adopt this. but it's a draft for a while now and afaict this is werner's solution to the keyserver flooding attacks [2,3] and it's all there from gnupg's standpoint. (also this is kinda a missing piece toward auto-magically enc of email which not only rely on a tofu scheme like autocrypt [4] solutions, namely a missing pki infra.)

any way. just some static files PLUS we need to put st like this in our nginx config and we are set:

location ^~ /.well-known/openpgpkey {
   default_type application/octet-stream;
   add_header Access-Control-Allow-Origin * always;
}

and to test it type:

gpg --auto-key-locate clear,nodefault,wkd --locate-keys mail@reudnetz.org

[1] https://www.ietf.org/archive/id/draft-koch-openpgp-webkey-service-21.txt :draft
[2] https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html :keyserver :flooding
[3] https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f :sks-server-under-attack
[4] https://docs.autocrypt.org/index.html

this way users can import our gpg key via gnupg (`gpg --locate-keys mail@reudnetz.org`) and maybe in some modern mua's? well, we have to see if mua's adopt this. but it's a draft for a while now and afaict this is werner's solution to the keyserver flooding attacks [2,3] and it's all there from gnupg's standpoint. (also this is kinda a missing piece toward auto-magically enc of email which not only rely on a tofu scheme like autocrypt [4] solutions, namely a missing pki infra.) any way. just some static files PLUS we need to put st like this in our nginx config and we are set: ```nginx.conf location ^~ /.well-known/openpgpkey { default_type application/octet-stream; add_header Access-Control-Allow-Origin * always; } ``` and to test it type: `gpg --auto-key-locate clear,nodefault,wkd --locate-keys mail@reudnetz.org` [1] <https://www.ietf.org/archive/id/draft-koch-openpgp-webkey-service-21.txt> :draft [2] <https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html> :keyserver :flooding [3] <https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f> :sks-server-under-attack [4] <https://docs.autocrypt.org/index.html>
this way users can import our gpg key via gnupg (`gpg --locate-keys
mail@reudnetz.org`) and maybe in some modern mua's?  well, we have to see if
mua's appodt this.  but it's a draft for a while now and afaict this is
werner's solution to the keyserver flooding attacks [2,3] and it's all there
from gnupg's standpoint.  also this is kinda a missing piece to the tofu scheme
of the opportunistic autocrypt [4] solution, namely a missing pki infra.

any way.  it's just some static files PLUS we need to put st like this in out
nginx config:

```nginx.conf
location ^~ /.well-known/openpgpkey {
   default_type application/octet-stream;
   add_header Access-Control-Allow-Origin * always;
}
```

and to test it type:

`gpg --auto-key-locate clear,nodefault,wkd --locate-keys mail@reudnetz.org`

[1] <https://www.ietf.org/archive/id/draft-koch-openpgp-webkey-service-21.txt> :draft
[2] <https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html> :keyserver :flooding
[3] <https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f> :sks-server-under-attack
[4] <https://docs.autocrypt.org/index.html>
nzeo commented 2026-05-22 16:04:16 +02:00
Author
Member
Copy link

ps. bin file is generated like below. (pls check yourself if your tinfoil-head demands it, as mine would certainly do 😄 )

MAILADDR=mail@reudnetz.org
LOCALHASH=$(gpg --with-wkd-hash --fingerprint mail@reudnetz.org | grep \.org$ | xargs | cut -d@ -f1) # dizb37aqa5h4skgu7jf1xjr4q71w4paq
gpg --no-armor --export $MAILADDR >$LOCALHASH
ps. bin file is generated like below. (pls check yourself if your tinfoil-head demands it, as mine would certainly do 😄 ) ``` MAILADDR=mail@reudnetz.org LOCALHASH=$(gpg --with-wkd-hash --fingerprint mail@reudnetz.org | grep \.org$ | xargs | cut -d@ -f1) # dizb37aqa5h4skgu7jf1xjr4q71w4paq gpg --no-armor --export $MAILADDR >$LOCALHASH ```
nzeo stopped working 2026-05-22 16:29:06 +02:00
6 seconds
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u wdk:nzeo-wdk
git switch nzeo-wdk

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff nzeo-wdk
git switch nzeo-wdk
git rebase master
git switch master
git merge --ff-only nzeo-wdk
git switch nzeo-wdk
git rebase master
git switch master
git merge --no-ff nzeo-wdk
git switch master
git merge --squash nzeo-wdk
git switch master
git merge --ff-only nzeo-wdk
git switch master
git merge nzeo-wdk
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Total time spent: 6 seconds
nzeo
6 seconds
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
reudnetz/website!12
No description provided.