Subject: Re: [smime] S/MIME publishing mailing list

From: Peter Gutmann <[email-masked]>
Date: Sat, 24 Jan 2015 01:35:00 +0000

Russ Housley <[email-masked]> writes:

>We need to make it easier to get certificates, and then we need to make it
>easier for others to find those certificates.  I'm willing to work on both of
>these.

What about Ian Grigg's GETSMIME proposal from many years ago?  It doesn't
really get any simpler than that, and it's something that anyone (up to and
including my cat, if she figures out email) can use:

https://financialcryptography.com/mt/archives/000966.html

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Sat, 24 Jan 2015 10:12:54 +0100

> https://financialcryptography.com/mt/archives/000966.html

I wholeheartly agree with the comment below the article above.

Also I wouldn't want my MUA to automagically send any e-mail.
Surely this would be abused in some way.

The really sad fact is that e.g. Mozilla's S/MIME support was much better in
Netscape Communicator in 1998. Back then you could simply retrieve the e-mail
cert via LDAP. Anyone remember signed attribute 'userSMIMECertificate' which
the user could create and send himself?

Ciao, Michael.

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 24 Jan 2015 08:20:25 -0800

> https://financialcryptography.com/mt/archives/000966.html

An understood Subject: is fine, so is a new header that is triggered by a UI element.

The problem is getting the MUAs to care enough about S/MIME to add code that would automatically respond to that message. MUA interest is zero, if not negative.

--Paul Hoffman

---

From: Russ Housley <[email-masked]>
Date: Sun, 25 Jan 2015 02:38:20 -0500

> https://financialcryptography.com/mt/archives/000966.html

I had not seen this paper before.  It looks very straightforward.

It seems pretty easy to combine with RFC 4387:

	Internet X.509 Public Key Infrastructure Operational Protocols:
	Certificate Store Access via HTTP. P. Gutmann, Ed.. February 2006.

Has RFC 4387 seen much implementation?

Russ

---

From: Russ Housley <[email-masked]>
Date: Sun, 25 Jan 2015 03:23:45 -0500

> the user could create and send himself?

When the S/MIME specifications were developed, LDAP was expected to be the main way that certificates get distributed.  That part just never happened....

Russ

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 25 Jan 2015 08:10:41 -0500

Hi Russ,

Not sure what the problem is other than end users
largely don't seem interested unless required.

My cert is attached if anyone wants to switch to
S/MIME.  You can set up the list to require certs
to post.  That would be an interesting step to take.
I'm using Thunderbird which offers great support.
Outlook's pretty good as well.  Several of the CAs
have long offered S/MIME optimized certs.

By the way, that funky CPOP/CMTP spec from
LegalBox is still floating around ITU-T.  It didn't
get enough support to get adopted.  It's prospects
at this point are uncertain.

-t

On 2015-01-25 3:23 AM, Russ Housley wrote:
> _______________________________________________
> smime mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/smime

---

From: Michael Ströder <[email-masked]>
Date: Sun, 25 Jan 2015 14:30:07 +0100

> Has RFC 4387 seen much implementation?

EJBCA has server support for it.

Personally I'm not aware of any client implementation.

Ciao, Michael.

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 26 Jan 2015 13:37:49 +0000

> Surely this would be abused in some way.

Countermeasures (e.g., response rate throttling) also abound.  As long as the MUA receiving the GETSMIME command doesn't copy anything from that command into the signed response I wouldn't be overly concerned re: actual cryptographic attacks (such as signature collisions).

> Netscape Communicator in 1998. Back then you could simply retrieve the 
> e-mail cert via LDAP. Anyone remember signed attribute 'userSMIMECertificate' 
> which the user could create and send himself?

It's widely implemented.

https://msdn.microsoft.com/en-us/library/ms680866(v=vs.85).aspx

And--in an *enterprise* environment--discovery via this method works quite well.  Invisibly, even (excluding error conditions).

Unfortunately, the One Directory to Rule Them All was a pipe dream, so we ended up with lots of smaller, *mutually unreachable* directories.  It's this partitioning that's the problem y'all want to tackle.

-- T

---

From: Michael Ströder <[email-masked]>
Date: Mon, 26 Jan 2015 15:26:30 +0100

Miller, Timothy J. wrote:
> Unfortunately, the One Directory to Rule Them All was a pipe dream, so we
> ended up with lots of smaller, *mutually unreachable* directories.  It's
> this partitioning that's the problem y'all want to tackle.

Mainly, yes.

Ciao, Michael.