integrate WKD public key search

[tomholub]

part of #275

trust it more than results on Attester (search first on WKD, then on Attester only if WKD doesn't return public key)

1. port Wkd class from browser extension https://github.com/FlowCrypt/flowcrypt-browser/blob/83047917fc3ef6853ef5323340a64d4b3703a9d3/extension/js/common/api/key-server/wkd.ts (parts of it already done in constructing WKD urls  #314 )
2. add tests for it independently of the rest of the codebase, merge the class unused. You can use robot@flowcrypt.com as a test-case that returns a public key. The public key is returned in binary format (unarmored) - I'm not sure if our Core class is able to process these yet. Try and see - let me know if not.
3. another PR once the step 2 is merged - to start using this class during public key lookups. For each new recipient, search on WKD first (with a 3 second timeout). Only if public key not found on WKD, then search on Attester (the currently implemented lookup method).

[tomholub]

Here is some code with the logic from browser extension at https://github.com/FlowCrypt/flowcrypt-browser/blob/master/extension/js/common/api/pub-lookup.ts

 public lookupEmail = async (email: string): Promise<PubkeysSearchResult> => {
 if (this.keyManager) {
 const res = await this.keyManager.lookupPublicKey(email);
 if (res.publicKeys.length) {
 return { pubkeys: res.publicKeys.map(x => x.publicKey) };
 }
 }
 const wkdRes = await this.wkd.lookupEmail(email);
 if (wkdRes.pubkeys.length) {
 return wkdRes;
 }
 if (this.internalSks) {
 const res = await this.internalSks.lookupEmail(email);
 if (res.pubkey) {
 return { pubkeys: [res.pubkey] };
 }
 }
 const attRes = await this.attester.lookupEmail(email);
 if (attRes.pubkey) {
 return { pubkeys: [attRes.pubkey] };
 }
 return { pubkeys: [] };
 }

In the case of iOS app, this will be simplified:

 public lookupEmail = async (email: string): Promise<PubkeysSearchResult> => {
 const wkdRes = await this.wkd.lookupEmail(email);
 if (wkdRes.pubkeys.length) {
 return wkdRes;
 }
 const attRes = await this.attester.lookupEmail(email);
 if (attRes.pubkey) {
 return { pubkeys: [attRes.pubkey] };
 }
 return { pubkeys: [] };
 }

[tomholub]

In general, the browser extension is a good place to look when unsure - but better ask before re-implementing something from the browser that looks weird :-) as it may not apply to iOS context.

[ekievsky]

@tomholub I've tried to sent the request to get policy as in extension and they return errors, sent request:
Basic: https://gmail.com/.well-known/openpgpke/policy - 404 status code
Advance: - https://openpgpkey.gmail.com/.well-known/openpgpkey/policy/gmail.com - A server with the specified hostname could not be found.

Is there anything should be added or changed?

[tomholub]

This is correct, Gmail does not run a WKD server.

any status code other than 200 at policy file (or no server found, or timeout after 2 seconds) means you should not try actual public key URL.

btw typo here: https://gmail.com/.well-known/openpgpke/policy

For testing successful result, look up robot@flowcrypt.com instead.

Also add a rule to never search gmail.com or googlemail.com domains (waste of time)

Thanks!

[ekievsky]

ah, right, it's in the description, sorry. It works now.

Thanks a lot!

[ekievsky]

@tomholub seems that class Wkd uses KeyUtil to read public key from buf. Looks like we don't have similar Util on iOS, should I create that first?

[tomholub]

This may be difficult for you. I’ll have a look on the weekend. is this blocking you - are there other things for u to do meanwhile?

…

On Wednesday, May 26, 2021, Evgenii Kievsky ***@***.***> wrote: @tomholub <https://github.com/tomholub> seems that class Wkd uses KeyUtil to read public key from buf. Looks like we don't have similar Util on iOS, should I create that first? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#296 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQDZELKWDSGDJBN2ZLJ4ULTPVEOVANCNFSM43XVUYIA> .

-- -- Tom James Holub <http://holub.me/>