Subject: RE: X.500, LDAP Considered harmful Was: OCSP/LDAP

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 15 Feb 2003 17:43:44 -0800

Eric,

	I did look into fixing SMTP to upport that mode. But SMTP is
really, really yukky, there are a lot of moving parts, lots of legacy
stuff.

	The proposal I am pushing is using the DNS to locate a discovery
service (SRV already supports this), with my preferred discovery service
being XKMS locate which is a lot simpler to implement than LDAP.

	It would also be possible to implement an HTTP interface on top
of NAPTR but SRV is not quite up to it.

		Phill

> -----Original Message-----
> From: Eric Norman [mailto:[email-masked]]
> Sent: Saturday, February 15, 2003 6:04 PM
> To: PKIX list
> Subject: Re: X.500, LDAP Considered harmful Was: OCSP/LDAP
> 
> 
> On Fri, 14 Feb 2003, Aram Perez wrote:
> 
> > Hallam-Baker, Phillip wrote:
> >
> > > Alice wants to send email to Bob
> > > Alice does not know Bob's Certificate
> > > Alice does know Bob's email address.
> > > Bob's name is not unique
> >
> > But Bob's email is unique. Why can't Alice look up Bob's 
> certificate by his
> > unique email address?
> 
> Going off on a tangent here, but it's a tangent that doesn't seem
> to have been explored.
> 
> Why can't Alice get Bob's up-to-date encryption certificate
> when she clicks on Bob's mailto URL?
> 
> 
> Eric Norman
> 
> 		"I may be just a butterfly,
> 		 but watch out if I flap my wings".
> 
> 
>

---

From: Eric Norman <[email-masked]>
Date: Sat, 15 Feb 2003 20:37:58 -0600 (CST)

> really, really yukky, there are a lot of moving parts, lots of legacy

I'm thinking something simpler.  Methinks I confused the idea by using
the phrase "mailto URL".  Perhaps I should have referred to it as
whatever you click on to send electronic mail to someone.

Trying to do it with SMTP would couple the message encryption process
with the process of injecting the message into the delivery system;
I don't think that's a good thing.

> being XKMS locate which is a lot simpler to implement than LDAP.

Since some browsers already support a MIME type for receiving encryption
certificates, I'm thinking that the "send me mail" link that someone puts
on (for instance) their home page includes an attribute that says how to
fetch their encryption key (probably from their home page file space in
this case).

Eric Norman

	"Congress shall make no law restricting the size of integers
	that may be multiplied together, or the number of times that
	an integer may be multiplied by itself, or the modulus by
	which an integer may be reduced".

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 18 Feb 2003 17:26:45 +0100

Phill,

>really, really yukky, there are a lot of moving parts, lots of legacy

When I wrote my posting the other day I referred to SMTP which
sure is as yucky as you say.  However, MIME-encode mail which
is pretty much standard, offers an "X-" extension which is similar to an
X.509.v3 non-critical extension.  Using MIME this should not
be a problem.

If you look into this mail you will find an X-OLE-something which
hardly can be anything but an undocumented MS-feature.

Anders