Subject: [Spasm] Towards OpenPGP / SMIME interoperability

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 18 Sep 2016 21:26:41 -0400

Wouldn't it be nice if we could get to the point where S/MIME and OpenPGP
are just message formats and clients will allow the use of any trusted key
to send a message regardless of which PKI it came from?

One of the really useful features of OpenPGP is the ability to create
direct trust links via fingerprints. Many S/MIME and PKIX clients use
fingerprints to identify certificates.

The OpenPGP group is currently looking at its v5 fingerprint format. I have
designed a proposal that allows one fingerprint format to be used with
multiple PKIs and key formats. The trick being to include some metadata
describing the data being fingerprinted within the scope of the digest.

Details of the generic scheme I have proposed are here:

https://tools.ietf.org/html/draft-hallambaker-udf-03

So the question here are

1) Do we think a fingerprint scheme has value in the S/MIME world?

2) If so is the S/MIME world prepared to use a fingerprint format that is
designed to enable use by multiple applications without cross semantics
attacks (e.g. attacker crafts PKIX cert to look like an OpenPGP key packet
with a different key).

I think that fingerprints could be very very useful as a means of
exchanging PKIX trust roots. So lets say I am hooking up my mail client to
the enterprise servers. Today I click to 'require TLS' but this says
nothing about which certs to accept. It seems to me that being able to
enter the fingerprint of the enterprise intermediate root under which all
the TLS certs are signed would allow security to be tightened up rather
usefully.