-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
2440bis specifies the IETF space as anything without a '@' sign in it,
so "COMMENT" would be a perfectly valid notation tag. Of course, it's
not perfectly valid since that tag was never assigned by the IETF, but
it is a tag that the IETF *could* use. The IETF hasn't assigned any
tags yet, so any tag without a '@' in it is currently an invalid tag.
I see... I had interpreted the "IETF name space" as an existing syntax
defined by IETF, something like the DNS name space or the ASN/OID name
space. David interprets it as a OpenPGP-specific name space, with no
specific structure yet defined, reserved for assignment by the IETF/IANA.
That's reasonable -- could one of the RFC authors confirm that this
is the intention?
There is no restriction as to what comes before the '@' (except that
it is UTF-8) so a user can certainly use tags of the form
"loginname+tagname1(_at_)(_dot_)(_dot_)(_dot_)",
"loginname+tagname2(_at_)(_dot_)(_dot_)(_dot_)", etc. It doesn't
have to be a valid email address, though it's nice if it is.
Yes, this is a fine approach *if the domain owner approves*. (Note
that "x+y(_at_)z" is a valid e-mail address in some domains. It usually
reflects a login name "x", but it need not.) My point wasn't that
a scheme couldn't be invented, simply that it's still really
a "DNS" name space, not a "user" space. It's only a few dollars
a year to own a domain name, though, so it's not a big deal.
I've actually been toying with the idea of disallowing any notation
name that doesn't have a "@" in it for GnuPG (with an override for
experts who presumably know what they are doing).
Given that the IETF name space is completely unallocated, I'd offer
another suggestion: change the RFC to reflect reality, and use
the *presence* of special character to mark the "IETF name space".
For example, tags starting with "$" could be the IETF space.
(David's keyserver analysis could give us a good idea what
characters haven't been used.) Let the space without either
special character remain the free-for-all that it has become.
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3
iQA/AwUBPcaZxFMkvpTT8vCGEQKeKgCgqZcxV9YL5e4QqV5jTs3IR1lpiSwAoOHP
cFyMqoxFftltUs7Bh2PE4Udo
=3p2d
-----END PGP SIGNATURE-----