KLS - Key List Server

By: Diane Shired, CTM

Meaning of KLS - "Key List Server" is where public keys are hosted. KLS will let you add and query keys, as well as update or delete keys. However, deleting keys from KLS can be very problematical. KLS are usually grouped into networks and stores a complete copy of all the global keys, simulating a global key ring. Each KLS keep one another informed of any additional keys that are received. Anyone can add a public key and all of the other servers will know about it within 48 hours. Anyone can query any KLS to obtain your public key.

Public keys on a server work together with a private key. The private key is only accessible by the owner.

As of November 2005 the following servers are considered “Dead Servers”, they cannot be queried via PGP software used to access KLS: keys.kadath.com.ar
netcat.upb.de
pgp.ael.be
pgp.demonserver.de (pgp.demonlord.de)
pgp.escomposlinux.org
pgp.isternet.sk
pgp.upb.de
wwwkeys.fi.pgp.net
wwwkeys.hu.pgp.net
wwwkeys.tw.pgp.net

Other Related Definitions:

"A public key cryptographic system works well for typical email exchanges. Each person uses two keys—a public key that is known to everyone and a private key that is known only to that individual. When Bill wants to send a secure email message to Bob, he uses Bob's public key to encrypt the message; Bob then uses his own private key to decipher it. Extending this type of security system to email list servers is flawed, however. When Bill wants to send a secure message to all of the other members of a list service, he must first send the message to the list server. The list server then decrypts the message and re-encrypts it for subscribers. This leaves the decrypted text of every message sent to the list server vulnerable, making the list server an attractive target for hackers. SELS protects messages at the list server by using software-based proxy re-encryption. Each public-key encrypted message sent to the list server is directly transformed into a private-key encrypted message that can be read by the receivers, without ever exposing the plaintext message. This ensures the confidentiality of all messages sent to the list." [NCSA - Khurana ]

"Each session key is hashed from the IPv4 or IPv6 source and destination addresses and key identifier, which are public values, and a cookie which can be a public value or hashed from a private value depending on the mode. The pseudo-random sequence is generated by repeated hashes of these values and saved in a key list. The server uses the key list in reverse order, so as a practical matter the next session key cannot be predicted from the previous one, but the client can verify it using the same hash as the server.

There are three Autokey protocol variants or dances in NTP, one for client/server mode, another for broadcast/multicast mode and a third for symmetric active/passive mode. The Association Management program documentation page provides additional details. For instance, in client/server mode the server keeps no state for each client, but uses a fast algorithm and a private value to regenerate the cookie upon arrival of a client message. A client sends its designated public key to the server, which generates the cookie and sends it to the client encrypted with this key. The client decrypts the cookie using its private key and generates the key list. Session keys from this list are used to generate message authentication codes (MAC) which are checked by the server for the request and by the client for the response. Operational details of this and the remaining modes are given in the Internet Draft cited at the end of this page." [Autokey Protocol - David L. Mills, PhD, Professor]

Related Links:

ServerWatch - List Server Roundup: The Key Players
Famatech - Key Features List
GFI - Key features of GFI MailEssentials

(C) Copyright Birds-Eye.Net, All rights reserved.
It is against the law to reproduce this content or any portion of it in any form without the explicit written permission of Birds-Eye Network Services, LLC. Federal copyright law (17 USC 504) makes it illegal, punishable with fines up to $100,000 per violation plus attorney's fees.