Mailing List Archive: Trying to get PKA working

Trying to get PKA working

Feb 21, 2024, 1:56 AM

Post #1 of 3 (78 views)

Hello all

I'm using gpg 2.2.19:

$ gpg --version
gpg (GnuPG) 2.2.19
libgcrypt 1.8.5
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/ubuntu/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

I've followed the instructions I found at
https://gushi.org/make-dns-cert/HOWTO.html to publish a public key via
a TXT record in DNS but, when I get to the testing step of:

echo "foo" | gpg --no-default-keyring --keyring /tmp/gpg-$$ --encrypt
--armor --auto-key-locate pka -r you@you.com

(where you@you.com is the address to be tested) then I get:

error retrieving '<email address>' via PKA: No name

I've tried testing it against the author's details
(danm@prime.gushi.org) but I get the same "No name" error.

There wasn't a configuration file in place for gpg so I created one
with just this entry:

auto-key-locate pka

Should there be other entries in that file? Is that why I'm getting
the "No name error"?

Thank you.

Regards

Philip

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Trying to get PKA working [ In reply to ]

gnupg-users at gnupg

Feb 21, 2024, 3:39 AM

Post #2 of 3 (78 views)

Permalink

Hi!

Please don't use PKA. Any remaining support will be removed anyway.
The Web Key Directory is a far better and easiert way to get
certificates. In fact it is enabled by default and used transparently
in Kleopatra and with the Windows GpgOL plugin. Other Unix mailers
might also have support for it.

https://wiki.gnupg.org/WKD

But take care; this is a wiki and information may be a bit confusing.
For example I would suggest to use the gpg-wks-client command
--install-key or even --mirror to prepare a local copy of the WKD and
then sync this to the server. This way you don't need to install the
web Key Server stuff etc.

Testing is a mere

gpg --locate-external-key -v foo@example.org

Salam-Shalom,

Werner

--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein

Re: Trying to get PKA working [ In reply to ]

gnupg-users at gnupg

Feb 21, 2024, 7:52 AM

Post #3 of 3 (78 views)

Permalink

Thank you, Werner, for your helpful reply.

One thing I would like to check. You said that gpg
--locate-external-key -v foo@example.org can be used to test this, and
that works. The wiki (https://wiki.gnupg.org/WKDHosting) says to use
gpg --homedir "$(mktemp -d)" --verbose --locate-keys
your.email@example.org ... and this doesn't work.

Should I be concerned? Do I need to change something for the latter
example to work? Or is that deprecated now and your example is the
valid one?

Regards

Philip

On Wed, 21 Feb 2024 at 11:39, Werner Koch <wk@gnupg.org> wrote:
>
> Hi!
>
> Please don't use PKA. Any remaining support will be removed anyway.
> The Web Key Directory is a far better and easiert way to get
> certificates. In fact it is enabled by default and used transparently
> in Kleopatra and with the Windows GpgOL plugin. Other Unix mailers
> might also have support for it.
>
> https://wiki.gnupg.org/WKD
>
> But take care; this is a wiki and information may be a bit confusing.
> For example I would suggest to use the gpg-wks-client command
> --install-key or even --mirror to prepare a local copy of the WKD and
> then sync this to the server. This way you don't need to install the
> web Key Server stuff etc.
>
> Testing is a mere
>
> gpg --locate-external-key -v foo@example.org
>
>
>
> Salam-Shalom,
>
> Werner
>
> --
> The pioneers of a warless world are the youth that
> refuse military service. - A. Einstein

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

Mailing List Archive

Mailing List Archive

Attached Files: