Subject: RE: [Simple] Issue 1: End-to-End encryption

From: "Burger, Eric" <[email-masked]>
Date: Tue, 8 Nov 2005 16:51:55 -0500

So the text should read something like

"The UAS SHOULD encrypt the IMDN, unless it doesn't feel like it."?

But seriously, who gets to chose?  I care about security.  I send a
message, requesting an IMDN.  The UAS is lazy and doesn't care about
security and sends a clear text IMDN.  I get pissed off.

Conversely, I don't care about security, I send a message, requesting an
IMDN.  The UAS was written by someone in the Security Directorate, and
uses strong encryption.  I have to spend cycles to decrypt the message.

On the other hand, I don't care about security and I somehow mark the
message to be in plain text.  I send a message, requesting and IMDN.
The UAS honors the request, which pisses off the UAS' user, because now
their information is in clear text.

So, if we don't go the simple route of all IMDN's are encrypted, we
should have:
 o  A mechanism to let the sender insist on encrypted IMDN
 o  A mechanism to let the sender insist on unencrypted IMDN
 o  A mechanism to inform the sender if their request cannot be honored

-----Original Message-----
From: Ben Campbell [mailto:[email-masked]] 
Sent: Tuesday, November 08, 2005 1:54 PM
To: Burger, Eric
Cc: Hisham Khartabil; [email-masked]
Subject: Re: [Simple] Issue 1: End-to-End encryption

I agree that these things should be SHOULD. I'd love them to be MUST,  
but I think that a MUST here will be summarily ignored by  
implementers, or just used as an excuse to ignore the spec.

As far as explanatory text goes, I think we are covered if the  
security considerations describe the implications of not encrypting.

On Nov 8, 2005, at 4:24 AM, Burger, Eric wrote:

> SHOULD's require explanatory text for when you don't need to do  
> whatever
> isn't a MUST.
>
> Text would be needed here.
>
> -----Original Message-----
> From: Hisham Khartabil [mailto:[email-masked]]
> Sent: Monday, November 07, 2005 1:58 PM
> To: Burger, Eric
> Cc: [email-masked]
> Subject: Re: [Simple] Issue 1: End-to-End encryption
>
> I would make it a SHOULD.
>
> Hisham
>
> On Nov 7, 2005, at 4:24 PM, Burger, Eric wrote:
>
>> The draft asserts that IMDN's MUST be end-to-end (S/MIME) signed at
> the
>> least, and preferably encrypted.  Is this OK with everyone?
>>
>> Pro:
>> Only way to ensure end-to-end security
>> Only way to have some modicum of privacy, especially when dealing  
>> with
>> B2BUA's.
>>
>> Con:
>> Is the key infrastructure extant to enable end-to-end encryption for
>> EVERYONE?
>> Some more processing at the sender and receiver.
>>
>> _______________________________________________
>> Simple mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/simple
>>
>
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: Tue, 8 Nov 2005 14:07:11 -0800

> "The UAS SHOULD encrypt the IMDN, unless it doesn't feel like it."?

Something more like "SHOULD encrypt, unless it determines that the  
cost of doing so outweighs its need for privacy, or it just can't  
encrypt because it does not have the necessary cert". I know that is  
not very satisfying, but from a pragmatic position, lots of deployers  
are going to ignore this even if it says MUST.

>  o  A mechanism to let the sender insist on encrypted IMDN

Agreed.

>  o  A mechanism to inform the sender if their request cannot be  

On the last two: Currently the UAS can refuse to send an IMDN for any  
reason, without explanation, right? Why is this different?

---

From: Aki Niemi <[email-masked]>
Date: Wed, 09 Nov 2005 00:38:59 +0200

>>  o  A mechanism to let the sender insist on encrypted IMDN

Huh?? You don't currently have any way of insisting that replies are 
encrypted, and those actually contain sensitive data (in most cases).

Why don't you simply say that if the message was encrypted, you need to 
encrypt the IMDN. Don't over-engineer this.

Cheers,
Aki

---

From: Hisham Khartabil <[email-masked]>
Date: Wed, 9 Nov 2005 00:22:23 +0100

On Nov 8, 2005, at 11:38 PM, Aki Niemi wrote:

> Why don't you simply say that if the message was encrypted, you need 
> to encrypt the IMDN. Don't over-engineer this.

I like that, you make the MDN as secure as IM it is for.

Hisham