How does Blockstack solve the problem of learning the PGP key of your friend if all you know is his email address ?
If email is not the lookup key, then there can be more than 1 profile matching this email. Which one do you choose?
Alternatively, if email is the lookup key, and Alice could register an md5 of her email, call it H, as H.id, then Alice would screwed if someone registered that before her (trying to impersonate her). Would you propose in this case that Alice would form a hash H = H(email + “1”), which would make the hash unique? Yet, if she does so, how would his friend Bob know to add “1” to his email without communication with Alice ?
And if Bob must must communicate with Alice securely before the lookup could be done, then what is the point of the lookup ? Then Alice can just tell Bob her key.
Hey @boris25 here’s how I’d do an email address to PGP key lookup:
email --> multiple profiles --> filter profiles for ones with verified emails --> sort the profiles by some ranking and grab the first --> grab the PGP key in the profile
To verify an email:
Update the profile to include an email verification in the form of an email sent by the email address, including the headers signed by the email servers (if you use Gmail, this will be signed by a key associated with gmail.com).
This is a great solution to a deep problem. However, it isn’t very specific really. I would like to have a complete solution to this from somewhere so I can go ahead with my application, which is a secure email client in java. I just want to plug in something that says ‘what is the certified id for this email’, where ‘data’ is any kind of thing I want to register, especially a public key. Actually, the plan would be to be able to have the person in control of any kind of particular name in a particular namespace be able to post some hash to it to verify it. For example, a twitter account should be possible to associate with an id by having some trusted authority go validate that the id has been tweeted by the account holder by looking into the twitter API to read the specific tweet. The trusted authority can be something running in Blockstack I think, but I don’t have the full details of Blockstack yet.
This ‘trusted authority’ of course should be distributed or somehow avoid any kind of X509 CA etc. Avoiding that is the whole idea. My app is ‘BoilerBase’ at https://boilerbay.com/boilerbase-email-project/. The installer for my GUI app can’t verify its own ownership of the twitter account, because then hackers could get the open source code, remove the verification code, and squat. So the verification has to happen by someone else than the installer itself. The installer can make the claim that it has the particular twitter address under control, but somehow else it must be verified.