HKP (protocol)

HKP (protocol)
Name	HKP
Title	HKP (protocol)
Established	1999
Developer	OpenPGP community
Type	Key server protocol
License	Open standard

HKP (protocol) is an application-layer protocol for distributing OpenPGP public keys via key servers. It enables clients such as GnuPG, Enigmail, and Kleopatra to search, retrieve, and submit keys to networked keyservers like SKS keyserver pool and keys.openpgp.org. HKP complements standards such as OpenPGP message format, RFC 4880, and integrates with tools including Thunderbird (email client), Mutt (email client), and Symantec Encryption Desktop.

Overview

HKP operates over Hypertext Transfer Protocol-style requests to provide a REST-like interface for key distribution across the OpenPGP ecosystem. Clients perform operations such as key lookup, retrieval, submission, and deletion against servers like the SKS keyserver pool and proprietary services operated by organizations such as MIT and CORP mail infrastructures. The protocol defines endpoints and parameters that map to actions used by software projects including GnuPG, Sequoia-PGP, Mailvelope, Kleopatra, and Enigmail to facilitate cryptographic interoperability across platforms like Linux, FreeBSD, Windows NT, and macOS.

History and Development

HKP originated in the late 1990s as part of the expansion of PGP Corporation-era practices and the OpenPGP standardization process led by contributors from IETF working groups. Early implementations were influenced by servers running on Debian and Red Hat systems and by academic deployments at institutions such as MIT and Harvard University. The protocol evolved alongside keyserver software projects like the SKS keyserver and later forks motivated by incidents involving GDPR compliance, operational abuse, and cryptographic hygiene. Prominent developers and organizations involved include contributors from GnuPG, OpenPGP.org, kayfabe, and individuals associated with GNU Privacy Guard development.

Protocol Specification

HKP models request semantics after HTTP/1.1 with query parameters for operations such as "get", "search", and "index". Typical endpoints accept parameters like "op=get" to retrieve armored ASCII armoring keys and "op=index" to search by email or key ID. The format encodes OpenPGP public key blocks following RFC 4880 and often pairs with MIME (Multipurpose Internet Mail Extensions) workflows for transport. Servers return content types compatible with RFC 2045 and utilize headers similar to RFC 2616. Implementations must handle keypacket formats defined by OpenPGP packet format and manage operations involving subkeys, user IDs, and signatures as specified by RFC 4880.

Security and Privacy Considerations

HKP's design predates contemporary privacy regulations like General Data Protection Regulation and lacks native mechanisms for access control, authenticated uploads, or selective disclosure. Public keyservers historically performed data mirroring across the SKS keyserver pool leading to persistence of submitted OpenPGP keys and attached user IDs, complicating Right to be Forgotten requests under GDPR. Attacks leveraging HKP infrastructure have included certificate poisoning and metadata harvesting by actors linked to incidents analyzed by researchers at EFF and CIRCL. Defenses include using authenticated key servers such as keys.openpgp.org that support email verification and Web of Trust hygiene practices advocated by GnuPG and OpenPGP community members. Additional mitigations include transport-layer protections via HTTPS endpoints and operational practices recommended by maintainers of SKS keyserver forks.

Implementations and Clients

Server implementations include the SKS keyserver, various keys.openpgp.org deployments, and commercial key discovery services integrated by vendors such as Mozilla and ProtonMail. Client-side support is present in GnuPG frontends like Kleopatra and Seahorse (software), mail agents including Thunderbird (email client), Evolution (software), and Mailvelope, and command-line tools shipped with distributions like Debian and Arch Linux. Library integrations exist in languages and projects such as Python bindings for GnuPG, Node.js modules used by Mailvelope, and native implementations in Sequoia-PGP written by contributors associated with NLnet Foundation.

Deployment and Usage

Administrators deploy HKP servers on web stacks using Apache HTTP Server or Nginx reverse proxies together with databases and synchronization daemons based on projects originating in communities like Debian and Gentoo. Operational concerns include handling key collision, lookup performance, and legal takedown requests influenced by case law in jurisdictions such as European Union member states and policy shifts at institutions like EFS and USENIX conferences. Enterprises such as Red Hat and research groups at MIT CSAIL have integrated key discovery into provisioning workflows and secure email deployments using tooling from GnuPG and OpenPGP.js.

Alternatives and Related Protocols

Alternatives and complementary systems include directory services such as LDAP with S/MIME certificate stores used by vendors including Microsoft and Entrust, decentralized approaches like Keybase (company) and DANE using DNSSEC records, and modern solutions in the WebAuthn and OpenID Connect ecosystems. Related protocols and standards include OpenPGP, RFC 4880bis drafts, HTTP/2 adaptations for key retrieval, and email-related specifications such as MIME (Multipurpose Internet Mail Extensions) and SMTP (Simple Mail Transfer Protocol). Research into replacement architectures has been presented at venues like USENIX Security Symposium and NDSS Symposium.

Category:Cryptographic protocols