Subject: Re: [VCARDDAV] Signed vCards

From: DataPacRat <[email-masked]>
Date: Mon, 1 Jul 2013 14:16:09 -0400

On Mon, Jul 1, 2013 at 11:50 AM, Simon Perreault
<[email-masked]> wrote:
> Le 2013-07-01 16:20, DataPacRat a écrit :
>
>> While playing with vCard as a container for time-and-space data is a
>> fun exercise, my primary use case is identity authentication over
>> otherwise anonymized networks such as Tor. While some forums thereon
>> could be referred to using the proposed acct: URI, using the forum's
>> .onion address and the user's account name, not all are so easy to
>> work with. (Eg, "I'm the person who programmed the software which made
>> the edit at 2010-11-12T12:34:56 to wiki page XYZ on site ABC.onion
>> (whose server lay in the house that Jack built).")
>
> Anytime anyone suggests a new way to do something with crypto, the
> obligatory "why not use PGP?" needs to be answered.
>
> So... Why not use PGP? :)

The answer to that is... I /do/ want to use PGP. :)

More specifically, I want to be sure that the KEY field in any given
vCard can point to (or contain) a PGP key, to use for hash-signing;
and PGP would probably be the easiest crypto algorithm to implement in
general.

Most of the point of having a signed vCard is to make arrangements for
easy and automated use /of/ PGP, to authenticate a vCard's data; and
to allow a vCard to associate a PGP key with an identity that may not
have an email address, and without necessarily directly relying on any
particular external keyserver system. (Further use for signed vCards,
the way I'm proposing them, is that current PGP web-of-trusts have
insufficient resolution for my purposes - there's no practical way to
figure out that a key is only 90% likely to actually be associated
with its given identity.)

Put another way, I'm hoping to end up with a way to swap out
pgp.mit.edu as one's PGP keyserver, replacing it with an ad-hoc
peer-to-peer distributed network roughly based on webfist, after
having corrected webfist's reliance on email keys as authoritative ID
strings. (And the more useful and easy-to-use I can make signed vCards
in the process, the more likely they are to be adopted more widely,
increasing the usefulness of the whole authentication system.)

Thank you for your time,
- --
DataPacRat
"If we are fervently passionate about the idea that fire is hot, we
are more rational than the man who calmly and quietly says fire is
cold." -- Tom McCabe