On Thu, 9 May 2019, juga wrote:
The last version of the draft [0] states:
Only if the required sub-domain does not exist, they SHOULD
fall back to the direct method.
Should implementations fall back to the direct method on any error
trying to fetch the key with the advanced method and not just when the
sub-domain doesn't exist?.
The SHOULD there is tricky. Unless you are using DNSSEC, the question
of "does a domain not exist" is very vulnerable to spoofing by an
attacker.
Paul
_______________________________________________
openpgp mailing list
openpgp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/openpgp