Subject: RE: Anti-spam news article / S/MIME Gateways

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 24 Jun 2004 21:44:12 -0700

Trevor,

	The CMS format is fine, 95% of the spec is fine.

	The problem is that there is a 5% gap between what S/MIME delivers
and what is needed.

	I think we can close the gap, the key is to throw away the bone
headed insistence that some people had concerning the end to end model or
nothing. We tried that for ten years, we ended up with nothing. IPSEC makes
a lousy VPN protocol for the exact same reason, give me something that
really works through a NAT box without complaint any day.

	What is needed is more than just better discovery protocols, or
logos in the certs. We need better client interfaces, we also need an in
band signalling mechanism so you know that when S/MIME enhancements are
being added that the channel can support them, including stripping them out
if some appliance or client turns out not to support them.

	[Draft to follow]

		Phill

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Trevor Freeman
> Sent: Thursday, June 24, 2004 1:42 PM
> To: Ben Littauer; [email-masked]
> Subject: RE: Anti-spam news article / S/MIME Gateways
> 
> 
> 
> Hi Ben
> I agree there are issues with the trust mechanisms etc. Domain signing
> is a good idea. What has that to do with the format and 
> encoding of how
> you sign a message? What part of CMS is so horribly broken 
> that we need
> another signature format?
> Trevor
> 
> * -----Original Message-----
> * From: [email-masked]
> [mailto:[email-masked]]
> * On Behalf Of Ben Littauer
> * Sent: Wednesday, June 23, 2004 6:34 AM
> * To: [email-masked]
> * Subject: Re: Anti-spam news article / S/MIME Gateways
> * 
> * 
> * There's scalability and there's scalability.
> * 
> * The problem with desktop to desktop PKI is both the 
> directory problem
> * (i.e.
> * key discovery and distribution) and the administration problem
> (issuance,
> * renewal, and revocation of certificates).  Domain-level PKI reduces
> the
> * scale of both problems by several orders of magnitude.  Solving the
> domain
> * level problems first will perhaps give some clue to the mechanisms
> * required
> * for the desktop implementation, should it ever become required.
> * 
> * -ben-
> * 
> * > From: "Trevor Freeman" <[email-masked]>
> * > Date: Tue, 22 Jun 2004 11:15:39 -0700
> * > To: "Craig McGregor" <[email-masked]>, "Russ
> Housley"
> * > <[email-masked]>, <[email-masked]>
> * > Subject: RE: Anti-spam news article / S/MIME Gateways
> * >
> * >
> * > Hi Craig,
> * > While I understand you comments about closed groups. The real
> problem
> * > with scaling beyond closed groups is, as you point out, trust
> * > mechanisms. What I fail to see is why we need a different 
> signature
> * > format to deploy a more scalable trust mechanism.
> * > Trevor
> * >
> * > * -----Original Message-----
> * > * From: [email-masked]
> * > [mailto:[email-masked]]
> * > * On Behalf Of Craig McGregor
> * > * Sent: Monday, June 21, 2004 8:12 PM
> * > * To: Russ Housley; [email-masked]
> * > * Subject: RE: Anti-spam news article / S/MIME Gateways
> * > *
> * > *
> * > *
> * > * >Tumbleweed Chief Executive Jeff Smith says there's a lot of
> * > * misunderstanding about
> * > * >S/MIME, because it was created as a desktop encryption
> technology. He
> * > * argues it's
> * > * > also simple and cost-effective to use as a gateway
> authentication
> * > * technology, and
> * > * > that its quality advantages make it the best choice. 
> Tumbleweed
> * > would
> * > * like to work
> * > * > with Yahoo to merge their technologies.
> * > *
> * > * S/MIME gateway software in the context of a 
> 'closed-community' is
> a
> * > * proven method of authenticating the sending domains of e-mail
> messages
> * > * and has been effective at blocking increased volumes of spoofed
> e-mail
> * > * messages (providing they were sent from a participating domain).
> And
> * > of
> * > * cause using S/MIME encryption protects one from in-transit
> * > eavesdropping
> * > * too!
> * > *
> * > * Applying what is quite managable in a 'closed-community' for an
> * > * Internet-wide deployment would be somewhat more challenging
> though.
> * > * Particularly around certificate deployment, trust-chains and
> * > * auto-discovery (assume DNS for internet-wide; a 
> 'closed-community'
> * > could
> * > * use LDAP). I think that is why domain keys proposes to trust DNS
> data
> * > as
> * > * being authorative without any further validation.
> * > *
> * > * Craig.
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * > *
> * >
> 
>

---

From: "David P. Kemp" <[email-masked]>
Date: Fri, 25 Jun 2004 09:12:03 -0400

Phill,

I'll look forward to the draft, to better understand what is needed
beyond user agent enhancements and "better discovery protocols".

    Client A  ---------> GW A -----------> GW B --------> Client B
                              \--------> GW C ---------> Client C

1. Assume no clients support S/MIME, A sends a message to B and C;
GW A needs to discover the gateways serving B and C and encrypt
to the appropriate GWs.

2. Assume only Client B supports S/MIME, GW A needs to discover
GW C and the fact that User B has a cert.

3. Assume only Clients A and B support S/MIME, Client A needs to
discover User B's cert and discover GW C's cert as a proxy for
email address of user C.

An in-band signalling mechanism can only work between signalling-
enabled nodes, which I assume means S/MIME-enabled nodes.  What
kind of signalling is needed other than agreed mechanisms
for handling mixtures of "[email-masked]" gateway certs, [email-masked]
user certs, and Bob (no email address, multi-mail-server) user
certs.  In other words, I don't see what in-band signalling
(contained in messages vs. certificates) you have in mind.

Of course we bone-heads want to ensure that when end-to-end
is available, a MITM can't exploit gateway features to bypass
it.  But that just means that end-to-end must have priority,
not that it's end-to-end or nothing.

Dave