Subject: Re: [pkix] purpose of LDAP in PKI

From: Peter Gutmann <[email-masked]>
Date: Wed, 20 Feb 2013 23:44:09 +0000

Phillip Hallam-Baker <[email-masked]> writes:

>What was never finished was the one mechanism that a client can apply to
>translate an SMTP email recipient address to the corresponding S/MIME
>configuration (including cert).

https://financialcryptography.com/mt/archives/000966.html

(OK, so it'd need to be written up as an RFC).

Peter.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 23 Feb 2013 09:42:09 -0500

Yuk!

An SMTP Message is not the right way to go here.

But why not add an SMTP transaction? It would be the logical way to
get keys for SMIME over SMTP. There would also need to be some
mechanism for managing keys between devices.

One of the big problems in the SMTP world is that there is no longer a
one to one mapping of clients to accounts. People read their mail on
multiple devices. Ergo end to end security simply does not work. At
the very least you need end to ends (plural) which means distributing
private keys across devices or you need end to service where the
emails are re-encrypted to get to the device.

On Wed, Feb 20, 2013 at 6:44 PM, Peter Gutmann
<[email-masked]> wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

-- 
Website: http://hallambaker.com/

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 25 Feb 2013 13:59:15 +0000

On 2/23/13 8:42 AM, "Phillip Hallam-Baker" <[email-masked]> wrote:

>multiple devices. 

I don't know about you, but IME reading email on multiple devices has
always been the case.  You have no idea how many helpdesk calls I fielded
at an ISP that started with "My email disappeared!"  (Think about late
90's POP3 services and you'll know why.)

By itself this doesn't mean end-to-end security is broken, it just means
users need private key portability and better public key discovery.  Well,
duh.  This isn't necessarily the fault of S/MIME; scoping the protocol as
it is makes sense *from a network engineer's perspective*.  No, it's not a
complete system (where are my -ilities?), but IETF doesn't build complete
systems.

But we should all know by now that S/MIME is the worst email security
protocol ever tried---except for all the others.  :)

-- T