Subject: [dane] SMIMEA prototyping

From: "Osterweil, Eric" <[email-masked]>
Date: Mon, 29 Sep 2014 11:44:31 +0000

Hey everyone,

A few of us at Verisign (actually, that would be Lynch Davis) have been working on a prototype for the SMIMEA draft.  We have written a general library+API, we have integrated it into Thunderbird, and have begun integrating into Mail.app.  Our plans are to publish this as open source at some point after the DANE workshop that will be taking place at ICANN 51 (where we will be demo'ing it).  We ran into numerous interesting wrinkles and made some specific design choices, but at a high level the S/MIME prototype:
- can sign
- can encrypt
- can decrypt (without writing clear text to disk)
- can verify
- and supports several features that are enabled through suggested additions.

With the foresight that zones may need to be delegated to accommodate churn and scale, some certificates may need to be selectively authenticated or deauthenticated (perhaps on a per-user basis), and the locations of certificate information may need to be managed in different places (some in the DNS, some in external locations), etc. we have made some operational choices to modify elements of the draft in our prototype.  We intend to detail these in a follow-on email.

We're hoping to show this off at the upcoming IETF too.

Eric

---

From: Richard Lamb <[email-masked]>
Date: Tue, 30 Sep 2014 18:36:14 +0000

Very cool.   Ive been waiting for the "killer app" and something better than
Kaminsky's Outlook+DNSSEC/phreebird demo of 2008.  I assume you mean DNSSEC
Workshop @ ICANN 51 usually on Wed.  Is a separate DANE workshop?

Looking forward to seeing the demo...
Rick

-----Original Message-----
From: dane [mailto:[email-masked]] On Behalf Of Osterweil, Eric
Sent: Monday, September 29, 2014 4:45 AM
To: dane WG list
Subject: [dane] SMIMEA prototyping

Hey everyone,

A few of us at Verisign (actually, that would be Lynch Davis) have been
working on a prototype for the SMIMEA draft.  We have written a general
library+API, we have integrated it into Thunderbird, and have begun
integrating into Mail.app.  Our plans are to publish this as open source at
some point after the DANE workshop that will be taking place at ICANN 51
(where we will be demo'ing it).  We ran into numerous interesting wrinkles
and made some specific design choices, but at a high level the S/MIME
prototype:
- can sign
- can encrypt
- can decrypt (without writing clear text to disk)
- can verify
- and supports several features that are enabled through suggested
additions.

With the foresight that zones may need to be delegated to accommodate churn
and scale, some certificates may need to be selectively authenticated or
deauthenticated (perhaps on a per-user basis), and the locations of
certificate information may need to be managed in different places (some in
the DNS, some in external locations), etc. we have made some operational
choices to modify elements of the draft in our prototype.  We intend to
detail these in a follow-on email.

Eric

---

From: ALAIN AINA <[email-masked]>
Date: Tue, 30 Sep 2014 18:48:37 +0000

This sounds interesting...

Thanks

--Alain
On Sep 29, 2014, at 11:44 AM, Osterweil, Eric wrote:

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: "Osterweil, Eric" <[email-masked]>
Date: Tue, 30 Sep 2014 19:41:14 +0000

On Sep 30, 2014, at 2:36 PM, Richard Lamb <[email-masked]> wrote:

> Workshop @ ICANN 51 usually on Wed.

Yup, that's the one!

>  Is a separate DANE workshop?
> 
> Looking forward to seeing the demo…

Great!

Eric