Subject: Re: [lamps] Proposed addition of header protection to the LAMPS charter

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 19 Dec 2018 19:09:23 -0500

On Mon 2018-11-05 22:34:33 -0500, Russ Housley wrote:
> In the session earlier today, there was interest in adding a header
> protection work item to the agenda.  Alexey talked about this in
> Montreal, and he posted a draft a few weeks ago:
> draft-melnikov-lamps-header-protection.  Several people said that they
> would implement a solution if the WG produced an RFC on this topic.

This seemed to be acceptable to folks in the room, and i've seen mainly
agreement on the list to adjust the charter in this way.

I propose the following change to the charter so that we can move
forward with adoption of this work:

--- a/lamps-charter.txt
+++ b/lamps-charter.txt
@@ -58,6 +58,14 @@ certificate for a trust anchor, which is often called a Root
 Certification Authority (CA) certificate, to identify the next
 public key that will be used by the trust anchor.
 
+7. Specify a mechanism for the cryptographic protection of e-mail
+headers.  Most current implementations protect only the body of the
+message, which leaves significant room for attacks against
+otherwise-protected messages.  Cryptographic protection (both for
+signatures and encryption) which applies to the headers in conjunction
+with the message body are necessary to close significant security and
+usability gaps in cryptographically-protected electronic mail.
+
 In addition, the LAMPS WG may investigate other updates to documents
 produced by the PKIX and S/MIME WGs, but the LAMPS WG shall not adopt
 any of these potential work items without rechartering.

happy to hear any concerns or suggestions for improvement!

Regards,

        --dkg

---

From: Sean Turner <[email-masked]>
Date: Wed, 19 Dec 2018 21:45:34 -0500

> On Dec 19, 2018, at 19:09, Daniel Kahn Gillmor <[email-masked]> wrote:
> 
> Signed PGP part

+1 to the addition.

spt

---

From: "John Levine" <[email-masked]>
Date: 20 Dec 2018 03:54:38 -0000

In article <[email-masked]>,
>happy to hear any concerns or suggestions for improvement!

Seems reasonable but you might want to be sure you're clear why this
is different from DKIM, which does after all sign headers now.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 20 Dec 2018 13:05:56 -0500

> is different from DKIM, which does after all sign headers now.

Do you want to propose a change to the text?  it seems pretty clear to
me that "for both signatures and encryption" puts it out of the realm of
what's solvable by DKIM, but i welcome amendments.

       --dkg

---

From: "John R Levine" <[email-masked]>
Date: 20 Dec 2018 14:34:35 -0500

> what's solvable by DKIM, but i welcome amendments.

No, so long as people are aware that DKIM has already addressed one part 
of this swamp, we're OK.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Bernie Hoeneisen <[email-masked]>
Date: Fri, 21 Dec 2018 10:55:48 +0100 (CET)

Hi Daniel

I am confused about the origin of the "proposed charter text" you are 

> +usability gaps in cryptographically-protected electronic mail.

Who drafted this charter text proposal and where has this been published 
before? I have been unable to find any traces on this mailing list. Does 
this origine from an IETF external source? Or is there some (hidden?) 
venue I am not aware of?

Thanks in advance for enlightening me on this process question.

Best,
  Bernie

--

http://ucom.ch/
Modern Telephony Solutions and Tech Consulting for Internet Technology

---

From: Russ Housley <[email-masked]>
Date: Fri, 21 Dec 2018 08:03:09 -0500

Bernie:
> 
> I am confused about the origin of the "proposed charter text" you are refering to and suggesting to amend:
> 
> Who drafted this charter text proposal and where has this been published before? I have been unable to find any traces on this mailing list. Does this origine from an IETF external source? Or is there some (hidden?) venue I am not aware of?
> 

This was discussed at the last two IETF meeting, and an individual Internet-Draft was posted.  In the room at the Bangkok IETF, people thought this was something the group should work on.  It is not covered by the current charter, so DKG is proposing charter text.

Russ

---

From: Bernie Hoeneisen <[email-masked]>
Date: Fri, 21 Dec 2018 14:52:45 +0100 (CET)

Hi Russ

Tahnks for your answer.

I am aware of the charter update discussion regarding header protection.

However, I am not aware that a concrete text for the charter update has 
already been (officially) proposed. In DKG's recent email to this list 
it looks like that there is an existing proposal, and DKG suggests a 
amend to this (in form of a diff). This is where my confusion is routed.

So, do I understand you correctly, that officially no concrete text for 
charter update has been proposed yet (for discussion)?

Are the chairs (or ADs) actually about to submit a proposal to the list 
to trigger the discussion or will it be the other way around?

cheers,
  Bernie

On Fri, 21 Dec 2018, Russ Housley wrote:

> This was discussed at the last two IETF meeting, and an individual 
> Internet-Draft was posted.  In the room at the Bangkok IETF, people 
> thought this was something the group should work on.  It is not covered 
> by the current charter, so DKG is proposing charter text.
>
> Russ
>
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 21 Dec 2018 09:45:03 -0500

Bernie:
> However, I am not aware that a concrete text for the charter update has already been (officially) proposed. In DKG's recent email to this list it looks like that there is an existing proposal, and DKG suggests a amend to this (in form of a diff). This is where my confusion is routed.
> 
> So, do I understand you correctly, that officially no concrete text for charter update has been proposed yet (for discussion)?

No.  I am saying that DKG is offering this text for discussion as the next step.  Please review and comment.

> Are the chairs (or ADs) actually about to submit a proposal to the list to trigger the discussion or will it be the other way around?

Once the WG discussion is complete, the ADs will put it in the Datatracker and discuss it on a telechat.

Russ

---

From: Bernie Hoeneisen <[email-masked]>
Date: Fri, 21 Dec 2018 15:48:31 +0100 (CET)

Hi Russ

Thanks for the clarifications on my process question. All clear now.

Merry Xmas!

cheers
  Bernie

--

http://ucom.ch/