Subject: Re: [pkix] purpose of LDAP in PKI

From: Peter Gutmann <[email-masked]>
Date: Sun, 24 Feb 2013 10:25:20 +0000

Phillip Hallam-Baker <[email-masked]> writes:

>An SMTP Message is not the right way to go here. But why not add an SMTP
>transaction? It would be the logical way to get keys for SMIME over SMTP.

What's the difference?  In this case you send a GETSMIME SMTP message and get
back an SMTP message with the keys.  That's both "SMTP message" and "SMTP
transaction", I'm failing to see what the difference is.

>One of the big problems in the SMTP world is that there is no longer a one to
>one mapping of clients to accounts. People read their mail on multiple
>devices. Ergo end to end security simply does not work. At the very least you
>need end to ends (plural) which means distributing private keys across
>devices or you need end to service where the emails are re-encrypted to get
>to the device.

Sure, the whole model is kinda broken.  OTOH GETSMIME fills a much-needed gap,
replacing the "Uh, could you email me your keys, I don't have a copy"
mechanism that's currently in use.

Peter.

---

From: Michael StJohns <[email-masked]>
Date: Sun, 24 Feb 2013 13:16:15 -0500

>mechanism that's currently in use.

Yup - and from the other end, "REGISTERSMIME" to store your cert with your local MTA/Message store so you don't have to be online for someone to get your cert.

But does that model work if you've got multiple MTAs between sender and receiver?  Does your local MTA translate the GETSMIME into a store and forward request of some sort?

Mike

>Peter.
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix