summaryrefslogtreecommitdiff
path: root/doc/TODO
blob: 6cc086ac6101e30f837b8a94511bf02b85af76dc (plain)
  1. Next-Steps Monkeysphere Projects:
  2. ---------------------------------
  3. Detail advantages of monkeysphere: detail the race conditions in ssh,
  4. and how the monkeysphere can help you reduce these threat vectors:
  5. threat model reduction diagrams.
  6. Handle unverified monkeysphere hosts in such a way that they're not
  7. always removed from known_hosts file. Ask user to lsign the host
  8. key?
  9. Work out the details (and describe a full use case) for assigning a
  10. REVOKER during monkeysphere-server gen_key -- how is this set? How
  11. do we export it so it's available when a second-party revocation is
  12. needed?
  13. Provide a friendly interactive UI for marginal or failing client-side
  14. hostkey verifications. Handle the common cases smoothly, and
  15. provide good debugging info for the unusual cases.
  16. Create ssh2openpgp or convert to full-fledged keytrans.
  17. Resolve the bugs listed in openpgp2ssh(1):BUGS.
  18. Understand and document the output of gpg --check-trustdb:
  19. gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
  20. gpg: depth: 0 valid: 2 signed: 20 trust: 0-, 0q, 0n, 0m, 0f, 2u
  21. gpg: depth: 1 valid: 20 signed: 67 trust: 15-, 0q, 1n, 3m, 1f, 0u
  22. gpg: next trustdb check due at 2008-10-09
  23. Understand and document the numeric values between sig! and the keyid
  24. in "gpg --check-sigs $KEYID" . Compare with the details found from
  25. "gpg --with-colons --check-sigs $KEYID". This has to do with trust
  26. signatures.
  27. Fix gpg's documentation to clarify the difference between validity and
  28. ownertrust. Include better documentation for trust signatures.
  29. Make it easier to do domain-relative ssh host trust signatures with
  30. gnupg. (e.g. "i trust Jamie McClelland (keyID 76CC057D) to properly
  31. identify ssh servers in the mayfirst.org domain") See:
  32. http://tools.ietf.org/html/rfc4880#section-5.2.3.21 and grep for
  33. "tsign" in gpg(1).
  34. Fix the order of questions when user does a tsign in gpg or gpg2.
  35. File bug against ssh-keygen about how "-R" option removes comments
  36. from known_hosts file.
  37. File bug against ssh-keygen to see if we can get it to write to hash a
  38. known_hosts file to/from stdout/stdin.
  39. When using ssh-proxycommand, if only host keys found are expired or
  40. revoked, then output loud warning with prompt, or fail hard.
  41. File bug against seahorse about how, when creating new primary keys,
  42. it presents option for "RSA (sign only)" but then creates an "esca"
  43. key.
  44. File bug against enigmail about lack of ability to create subkeys.
  45. Test and document what happens when any filesystem that the
  46. monkeysphere-server relies on and modifies (/tmp, /etc, and /var?)
  47. fills up.
  48. Optimize keyserver access, particularly on monkeysphere-server
  49. update-users -- is there a way to query the keyserver all in a
  50. chunk?
  51. Create DSA authentication subkey for server during gen-key
  52. Fix behavior when add-identity-certifier fails to fetch a key from the
  53. keyserver.
  54. Allow server administrators to add-identity-certifier from a key in
  55. the filesystem (or on stdin, etc)
  56. Think about packaging monkeysphere for other (non-apt-based) operating
  57. systems. RPM-based linux systems, FreeBSD ports, and Mac OS X seem
  58. like the most likely candidates.