[mats] PGP keyserver

A server that :

1. Accepts key material both via GnuPG's direct call on port 11371 or through a plain post request (armored pubkey) on port 80 ;
2. Verifies key material so that it is RSA, at least 4096 bits ;
3. Verifies key material through phuctor to eliminate weak keys (phuctor code does not need to be rewritten) ;
4. Verifies key material was created by a GnuPG version ulterior to 1.4.10 and prior to 1.4.20 ;
5. Verifies that key material is not set to expire ;
6. Emails the contained address an error if tests 2 or 3 above are failed (all addresses involved in case of 3), and rejects the key. Emails the contained address an explicatory warning if test 4ⁱ or 5ⁱⁱ above is failed, but accepts the key. Emails the contained address a confirmation if no tests are failed.
7. Answers for requests for specified keys on the normal hkp port (11371) as expected by GnuPG.
8. Displays keys in a plain manner similar to sks-keyservers but with all the colorful joy of phuctor's css.
9. Allows web-based searches for keys, by the various fields and by fragments of fingerprint (Allowing regexp, for instance a search for "?98.B30?" should return "EA0F AD90 985B 3025 576A 5061 454B 0FC0 BC07 B87E")
10. Maintains the strong set, displays some statistics as to it in the manner of Penning's thing
11. Allows the extraction of moduli in base64 (as Hanewinkel's tool) as well as the creation of encrypted messages via javascript for an arbitrary key the user selects.
12. Provides daily back-ups of its entire key database. The backup is hashed and the hash introduced as a deed into deedbot each day.

1. "PGP was originally deemed a weapon and declared a controlled export by the USG. This classification has changed, but PGP's substance has not. As its importance for a free world has grown exponentially in the past years, the efforts of the USG to quietly subvert it have increased feverishly.

   It is our considered opinion that one is ill advised to use unsupported implementations or unsupported versions of supported implementations, except in the case where that one has personally read the entire code involved and is confident in his ability to spot subtle subversion in critical cryptographic code.

   Friends don't let friends' heart bleed!" [↩]

2. There does not currently exist a correct implementation of time for this purpose. (If you wish to understand the problem, one path towards it would be - consider how would you go about making a system where material signed by an expired key remains valid past the key's expiration, but no further material may be signed after that date).

   There are some efforts currently underway to address this problem the only way it can be correctly addressed - through reference to the Bitcoin block number - but they will not be released as a patch for GnuPG - instead they will come as part of a complete replacement." [↩]