0

I wish to privately submit my public key (without it being sniffed on the internet). I found that I have 3 ways to connect to the keyserver securely:

  1. https://<keyserver-url>
  2. hkps://<keyserver-url> (HKP over TLS)
  3. hkp://<keyserver-onion> [Using TOR]

Which one of the 3 is most secure? I'm surprised to find that the Tor keyservers only use hkp and not hkps.

https keyservers are working with ipv4 to search and submit keys but it's hard to find hkps server working with ipv4.

Improve this question
7
  • What do you mean "it's snooping on the internet"?
    – multithr3at3d
    Jun 27, 2020 at 14:53
  • All .onion connections are already end-to-end encrypted, so hpks over tor makes no sense.
    – mricon
    Jun 27, 2020 at 15:44
  • You are afraid of someone getting your public key? What exactly are you trying to protect against?
    – user1301428
    Jun 27, 2020 at 20:51
  • "All .onion connections are already end-to-end encrypted, so hpks over tor makes no sense." If all connections are encrypted then why tor-browser uses https-everywhere or it is recommended to use https-everywhere??
    – ls_milkyway
    Jun 28, 2020 at 6:37
  • "You are afraid of someone getting your public key? What exactly are you trying to protect against?" Public key never mean that it is linked to some real identity...it can simply mean a real email address and the email service provider can be riseup or any one willing to provide private email. Further fingerprints verification can be requested by a known or trusted party with reliable contact or just be physically present...it's not that the whole world should know whose public key it is on the key-server.
    – ls_milkyway
    Jun 28, 2020 at 6:49

1 Answer 1

Reset to default
0

Options 1 and 2 seem very similar, since both rely on the TLS protocol, so which is more secure will depend on the nature of the certificates (key size, supported algorithms) and the configuration of the servers (version support).

Tor on the other hand tries to protect the origin of the communication, so it adds an extra layer of protection to hide the address where the request comes from.

There was some paper explaining why TOR may be vulnerable if an observer has control of several routing AS, but in that case, the observer must have huge control of the network.

If you are the only one using TOR in your context, and your are trying to protect from some sniffer, TOR traffic may at least reveal some of your activity.

Improve this answer
1
  • I guess that using bridges in TOR will be more safer (I read it somewhere) with an .onion DNS service.....assuming TOR is running on safe environment.
    – ls_milkyway
    Jul 3, 2020 at 18:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .