Daniel Colquitt<p><a href="https://mathstodon.xyz/tags/NerdToot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NerdToot</span></a></p><p>This week I set up my own Web Key Directory (<a href="https://wiki.gnupg.org/WKD" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="">wiki.gnupg.org/WKD</span><span class="invisible"></span></a>) on my website. This allows people/email clients to look up my OpenPGP public key (<a href="https://www.openpgp.org/" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://www.</span><span class="">openpgp.org/</span><span class="invisible"></span></a>) — yes, I am one of *those* people.</p><p>OpenPGP is a standard for Public-key cryptography (<a href="https://en.wikipedia.org/wiki/Public-key_cryptography" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">en.wikipedia.org/wiki/Public-k</span><span class="invisible">ey_cryptography</span></a>), which allows for the exchange of encrypted messages through the sharing of public keys.</p><p>In a nutshell, if you want to send a secure email to me, you use my public key to encrypt the message. I then use my private key to decrypt the message. I can share my public key freely, since it can only be used to encrypt (and verify) messages and only my private key can be used to decrypt the messages.</p><p>The most gnarly part of PGP has always been key distribution. Because there are no central key authorities for PGP we had to rely on the web of trust (<a href="https://en.wikipedia.org/wiki/Web_of_trust" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">en.wikipedia.org/wiki/Web_of_t</span><span class="invisible">rust</span></a>) which, quite frankly, we an absolute mess and never really worked. Key servers also have their own share of problems (<a href="https://en.wikipedia.org/wiki/Key_server_(cryptographic)#Problems_with_keyservers" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">en.wikipedia.org/wiki/Key_serv</span><span class="invisible">er_(cryptographic)#Problems_with_keyservers</span></a>). Essentially, the only way that you could be sure that you had my public key was to either ask me directly, or get it from someone that you trust.</p><p>The advantage of WKD is that you can obtain public keys directly from the domain over HTTPS. This means that in order to obtain my public key, you only need to trust that I control the domain danielcolquitt.com. If you use a WKD capable email client, you won’t even have to do anything, your client should automatically fetch the public key for you.</p>