Subject: Re: Encrypt subject

From: Karl Kashofer <[email-masked]>
Date: Thu, 01 Sep 2005 11:15:40 +0100

Hi !

> The problem is that we do sort of have a solution to this already, which
> Werner described: use PGP/MIME.  MIME allows for embedding one email
> message inside another, and the MIME security extensions, including
> PGP/MIME, show how to encrypt such an embedded message.

Well the way Werner describes it, he just advises not to use a Subject.

>>Simply send your mail as an encrypted message/rfc2822 MIME message and
>>put an innocent subject into the header.

> The problem is that almost no mailers support this.  Few enough even
> support PGP/MIME, and then they would also have to be smart enough to
> figure out what to do with an embedded email message.  Replacing the
> enclosing message's headers with those from the embedded message is not
> an obvious thing to do.

So this would adhere to the standards, and allow to embed headers inside
the PGP encryption block ?

Could you by any means describe this in more detail ?

I would try to bring it to the attention of enigmail developers, maybe
they are interested in it.

They have Per-Recipient-Rules, so it would be possible to implement
that, and then specify it in these rules, so its only used for
recipients which are able to decrypt it. I do that with PGP/MIME to only
use it for thunderbird recipients, works fine.

I would really like to see this implemented, and I am sure it annoys a
few other people as well.

Cheers,
Karl

---

From: Werner Koch <[email-masked]>
Date: Thu, 01 Sep 2005 15:48:36 +0200

> Well the way Werner describes it, he just advises not to use a Subject.

What I mean is that a subject you need to decrypt first is not very
usable for the purpose a subject line is commonly used, i.e. to
quickly decide what messages belong together and whether to read them.

With a slow connection and POP3 and with IMAP in general many people
just look at the subject to decide whether to retrieve the entire
message.  Requiring to decrypt it first make no sense then.

So, my suggestion is to use a non-sense subject line to merely help
visualizing a theread.

> Could you by any means describe this in more detail ?

Something like this:

    From: [email-masked]
    To: [email-masked]
    Subject: none 
    Content-Type: multipart/encrypted; 
                  protocol=application/pgp-encrypted;
                  boundary="xxxxxx"

    --xxxxxx
    Content-Type: application/pgp-encrypted
    
    Version: 1
    
    --xxxxxx
    Content-Type: application/octet-stream
    
  & Content-Type: message/rfc822; boundary="yyyyy"
  & 
  &
  & --yyyyyy
  & From: [email-masked]
  & To: [email-masked]
  & Subject: Don't tell anyone that PGP/MIME just works
  & Content-Type: text/plain
  &
  & Proposal on how to gain world domination of PGP/MIME
  & and to abolish any use of S/MIME.
  &
  & --yyyyyy--

    --xxxxxx--

Where the lines marked by "&" are actually encrypted.

Salam-Shalom,

   Werner

---

From: Karl Kashofer <[email-masked]>
Date: Thu, 01 Sep 2005 20:24:54 +0100

Hi !

> message.  Requiring to decrypt it first make no sense then.

I see what you mean, but from a practical point of view, how much PGP
encrypted spam have you gotten lately ?

I assume if its encrypted it might actually be worth reading ?

> So, my suggestion is to use a non-sense subject line to merely help

Sure, but if enigmail were able to permanently decrypt messages this
could still be accomplished once the message is decrypted. Problem seems
to be that mozilla/thunderbird does atm not allow them to permanently
modify the message, so it might take a while to implement that anyway.

Thanks for your help,
I will carry this to the enigmail mailing list,
Cheers,
Karl

---

From: Werner Koch <[email-masked]>
Date: Fri, 02 Sep 2005 09:00:00 +0200

> encrypted spam have you gotten lately ?

I was not talking about spam but on how to prioritize/ignore regular
mail.

Salam-Shalom,

   Werner