IETF Logo Mail Archive

Re: [Endymail] [kitten] Group/Enterprise encrypted email

"Nordgren, Bryce L -FS" <bnordgren@fs.fed.us> Mon, 01 June 2015 18:25 UTC

Return-Path: <bnordgren@fs.fed.us>
X-Original-To: endymail@ietfa.amsl.com
Delivered-To: endymail@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C41D61B30C6; Mon, 1 Jun 2015 11:25:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qtXlswH_tqIs; Mon, 1 Jun 2015 11:25:06 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0055.outbound.protection.outlook.com [207.46.100.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74EC91B30B6; Mon, 1 Jun 2015 11:24:54 -0700 (PDT)
Received: from CO2PR06CA044.namprd06.prod.outlook.com (10.141.242.44) by CY1PR0601MB1563.namprd06.prod.outlook.com (25.163.232.141) with Microsoft SMTP Server (TLS) id 15.1.172.22; Mon, 1 Jun 2015 18:24:53 +0000
Received: from BL2FFO11OLC015.protection.gbl (2a01:111:f400:7c09::142) by CO2PR06CA044.outlook.office365.com (2a01:111:e400:142a::44) with Microsoft SMTP Server (TLS) id 15.1.172.22 via Frontend Transport; Mon, 1 Jun 2015 18:24:53 +0000
Authentication-Results: spf=pass (sender IP is 199.135.140.18) smtp.mailfrom=fs.fed.us; MIT.EDU; dkim=none (message not signed) header.d=none;
Received-SPF: Pass (protection.outlook.com: domain of fs.fed.us designates 199.135.140.18 as permitted sender) receiver=protection.outlook.com; client-ip=199.135.140.18; helo=mail.usda.gov;
Received: from mail.usda.gov (199.135.140.18) by BL2FFO11OLC015.mail.protection.outlook.com (10.173.160.81) with Microsoft SMTP Server (TLS) id 15.1.184.11 via Frontend Transport; Mon, 1 Jun 2015 18:24:52 +0000
Received: from 001FSN2MPN1-046.001f.mgd2.msft.net ([169.254.6.131]) by 001FSN2MMR1-008.001f.mgd2.msft.net ([199.135.140.18]) with mapi id 14.03.0224.003; Mon, 1 Jun 2015 18:24:29 +0000
From: "Nordgren, Bryce L -FS" <bnordgren@fs.fed.us>
To: Benjamin Kaduk <kaduk@MIT.EDU>
Thread-Topic: [kitten] Group/Enterprise encrypted email
Thread-Index: AdCaU4EBKI9vXfbmSrKplnpcKmT5cgAGnCmAAIkbNEA=
Date: Mon, 01 Jun 2015 18:24:29 +0000
Message-ID: <82E7C9A01FD0764CACDD35D10F5DFB6E7DFBF9@001FSN2MPN1-046.001f.mgd2.msft.net>
References: <82E7C9A01FD0764CACDD35D10F5DFB6E7DF8C3@001FSN2MPN1-046.001f.mgd2.msft.net> <alpine.GSO.1.10.1505292012130.22210@multics.mit.edu>
In-Reply-To: <alpine.GSO.1.10.1505292012130.22210@multics.mit.edu>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [166.7.27.143]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11OLC015; 1:yZeta8lB2RFZPu3s1UKcao8/t4HCmx6whVqi3O3J3mfFGj0NYGm5+fxaUvw1gSVRb3Cbky4d3TeCLFuGaUyh6GeFhKBP7H2v2QIfUJ/bVXan+W9gqzTjkg/QgnO/Z7JzWqa5RVH772S46WiLoh2W/9YP9TDNuhUiBDXdoDGS2pF8FSIXgbmuN6CTG8Ie44+82VVzjtvsAAU90crEMmhEIT7ebkjAumisOuM+mkwSm4it2OoiaLH66QGQoobQ+rpAzv0+189eSllA6OxKPPLytJ1dR/Btrb8AMR+jFt7hq7I=
X-Forefront-Antispam-Report: CIP:199.135.140.18; CTRY:US; IPV:CAL; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10009020)(6009001)(438002)(199003)(13464003)(164054003)(51704005)(189002)(87936001)(2656002)(2171001)(22756005)(55846006)(64706001)(77156002)(97756001)(68736005)(102836002)(22746005)(62966003)(46406003)(46102003)(6806004)(47776003)(74482002)(66066001)(19580395003)(19580405001)(69596002)(92566002)(86146001)(566704002)(50986999)(50466002)(561944003)(26826002)(86362001)(33656002)(76176999)(54356999)(104016003)(5001860100001)(2920100001)(5001960100002)(5001830100001)(5001920100001)(81156007)(106466001)(110136002)(4001540100001)(2950100001)(2900100001)(189998001)(23726002)(97736004)(80862005)(79686002); DIR:OUT; SFP:1101; SCL:1; SRVR:CY1PR0601MB1563; H:mail.usda.gov; FPR:; SPF:Pass; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en;
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY1PR0601MB1563;
X-Microsoft-Antispam-PRVS: <CY1PR0601MB156340DEC6537EFF1C66D7F8E5B60@CY1PR0601MB1563.namprd06.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(5005006)(520003)(3002001); SRVR:CY1PR0601MB1563; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0601MB1563;
X-Forefront-PRVS: 05947791E4
X-OriginatorOrg: fs.fed.us
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2015 18:24:52.7751 (UTC)
X-MS-Exchange-CrossTenant-Id: 49808c08-7df8-4c41-af62-7a0827de9408
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=49808c08-7df8-4c41-af62-7a0827de9408; Ip=[199.135.140.18]; Helo=[mail.usda.gov]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0601MB1563
Archived-At: <http://mailarchive.ietf.org/arch/msg/endymail/jfq_J1pFPqqN4yXuahHi9ZMbXUI>
X-Mailman-Approved-At: Mon, 01 Jun 2015 12:35:25 -0700
Cc: "kitten@ietf.org" <kitten@ietf.org>, "endymail@ietf.org" <endymail@ietf.org>
Subject: Re: [Endymail] [kitten] Group/Enterprise encrypted email
X-BeenThere: endymail@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <endymail.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/endymail>, <mailto:endymail-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/endymail/>
List-Post: <mailto:endymail@ietf.org>
List-Help: <mailto:endymail-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/endymail>, <mailto:endymail-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Jun 2015 18:25:08 -0000


> -----Original Message-----
> From: Benjamin Kaduk [mailto:kaduk@MIT.EDU]
>
> You might have better luck on the endymail list, which is considering ways to
> improve email privacy.  I don't recall whether a scheme substantially similar
> to your proposal has been discussed there, but there should be a good crop
> of people interested in improving the state of email to comment there.

Hi Ben and Nico, 

I thumbed through the endymail archives and things appear to be sort of dead. I forwarded the message there anyway just in case someone's still listening. Lot of activity at first, then nothing till now. I just thought it was kind of neat. :) If it fails to spark any discussion I'll move on.

My proposal seems to get around a few of the problems endymail identified simply by using a per-message key for in-flight data only. Quite a lot of the endymail discussion revolves around key management/distribution for end users. All of it involves using something related to the user's identity to encrypt email. My proposal appears to be distinct from anything discussed there because of my focus on per-message keys unrelated to anyone's identity. This also distinguishes it from Identity based encryption (thanks Nico!). The EKG never holds (or releases) keys related to someone's identity. This scheme has the potential to be a form of OTR protection by configuring the EKG correctly, anthough if you configure the EKG to hand the key out like candy, why bother encrypting it? Enterprises will likely not configure their key guardians in this way.

Drawbacks are that you can only send encrypted email if your email provider operates an EKG, you and all your recipients have been issued "email address certificates" by the respective mail providers, and your recipients must have a PKI anchor your email provider is configured to trust. For enterprises interested in protecting their IP and operating their own email servers, this is not likely to be problematic. I suspect webmail clients could also participate, as the webmail server would be decrypting the message and then displaying it over https.

Thanks,
Bryce

v2.23.0 | Report a Bug | By Email