Re: Encryption simplification
Costin Manolache <costin@gmail.com> Mon, 31 October 2016 17:54 UTC
Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CC5A129987 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Mon, 31 Oct 2016 10:54:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.497
X-Spam-Level:
X-Spam-Status: No, score=-8.497 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mYdRHvzY12A4 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Mon, 31 Oct 2016 10:54:26 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E335A129986 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Mon, 31 Oct 2016 10:54:25 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1c1Gjj-0002AW-1a for ietf-http-wg-dist@listhub.w3.org; Mon, 31 Oct 2016 17:51:07 +0000
Resent-Date: Mon, 31 Oct 2016 17:51:07 +0000
Resent-Message-Id: <E1c1Gjj-0002AW-1a@frink.w3.org>
Received: from mimas.w3.org ([128.30.52.79]) by frink.w3.org with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <costin@gmail.com>) id 1c1Gjd-000296-Nu for ietf-http-wg@listhub.w3.org; Mon, 31 Oct 2016 17:51:01 +0000
Received: from mail-yw0-f182.google.com ([209.85.161.182]) by mimas.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <costin@gmail.com>) id 1c1GjX-0004fE-LC for ietf-http-wg@w3.org; Mon, 31 Oct 2016 17:50:56 +0000
Received: by mail-yw0-f182.google.com with SMTP id t125so8686787ywc.1 for <ietf-http-wg@w3.org>; Mon, 31 Oct 2016 10:50:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Axt8bkFXbfnHcv0J2GkuCbWeaAI3J44HNq/ABIEdlYk=; b=mVswGIPusqBQQg35nJIeAHXNzgrH63n1o38LLWh7hH2pul89otemfIMlo21A0AOLd+ d6FRZgFMg1kvUz2s26PlNq+UbcNS5bZxwtI5s1bRmZOcT7I5uyHCMoTWlKf4sHzFn8Dw dDyzNi4nK0nSwOkBLuhSUeVMqaUIRCmUgUMvL84pC07h9UJgi9IZzKD1W1421q9AAhbG dWp8I5TO2nyAQ07bI/CoCuT72DczDe4gUNJ9v+g5emsaKAdaV7HB77yXHkOam2AeN9eW doB5xpcKtBwRTiXo373W5rjHlffEM7D1w588XdpPQ4Ke28ceh7ODJ9kqNyxAqE8kSQzt j9dQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Axt8bkFXbfnHcv0J2GkuCbWeaAI3J44HNq/ABIEdlYk=; b=QyaGa4D2vVMSfuC9WBC/aAwpXJSzA3+TyiHbsrsvW5HoDSrP7nbCtgYocrWMHSpHir zdJx9O0M/bzQ0fouU5Nl/prA+W4SBSnsqCLs4nXcoM73DdE2dkdtiXPqYjN6m0yMsxee TBmOj0YY/zZTUXYDF4LpqZ1S6CTa+xayPJPiVs4eshUrNAW+dzpXVLl9fX1pkuXrnujB TvtX083hpebpXZpaUT2Ws4bpRmyUc9mRPkLQea2CX+jGj5yDlPpjEkCH6uHaoVCu4GvP DsgUKw0tLRWJWAtlmLxaqi2Dlc5sHkcajh8nF3+U5SiUEYsvNO6c8riel082mVG2nui+ 3WeQ==
X-Gm-Message-State: ABUngvdVbZePfzUbcCQoJbR6SsVylY/ZTUGrBJO7IY4oEZTwDpY0z7QLPxv29ZXxCIKpFquMXb0yANiBIdqRlA==
X-Received: by 10.36.27.68 with SMTP id 65mr8440710its.21.1477936229319; Mon, 31 Oct 2016 10:50:29 -0700 (PDT)
MIME-Version: 1.0
References: <922b5d40-3c8e-4642-17ec-0034ff841d9d@gmx.de> <20161030182604.36ED312C6B@welho-filter3.welho.com> <CABkgnnUJhvt3NzUOYQ7fq9Twc8K65BtXroQ_LUHbranuqRv0mw@mail.gmail.com> <CAP8-FqneP57fhwQD1eFAw4D=PAe9uhtsjJ_2AqFAkZFTJcBJBQ@mail.gmail.com> <201610311654.u9VGsBGE021539@shell.siilo.fmi.fi>
In-Reply-To: <201610311654.u9VGsBGE021539@shell.siilo.fmi.fi>
From: Costin Manolache <costin@gmail.com>
Date: Mon, 31 Oct 2016 17:50:18 +0000
Message-ID: <CAP8-FqnvPOSDqYRNKqXy8TOVA5fAR32ZemsYof2z8Z2hLkTkmQ@mail.gmail.com>
To: Kari Hurtta <hurtta-ietf@elmme-mailer.org>
Cc: Martin Thomson <martin.thomson@gmail.com>, Julian Reschke <julian.reschke@gmx.de>, HTTP working group mailing list <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary="001a1144847af3221c05402cd721"
Received-SPF: pass client-ip=209.85.161.182; envelope-from=costin@gmail.com; helo=mail-yw0-f182.google.com
X-W3C-Hub-Spam-Status: No, score=-2.4
X-W3C-Hub-Spam-Report: AWL=1.093, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: mimas.w3.org 1c1GjX-0004fE-LC 647e1f65300596f2c0169e217d94f2a9
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Encryption simplification
Archived-At: <http://www.w3.org/mid/CAP8-FqnvPOSDqYRNKqXy8TOVA5fAR32ZemsYof2z8Z2hLkTkmQ@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32755
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>
I'm not sure I understand - if symmetric keys are used: 1. They should not be sent along with the content 2. If they are for some reason, it doesn't make a difference if it's in header or body 3. The server storing the encrypted content would need to have access somehow to the key, if it is to be send to the user 4. If they do have access - it doesn't matter if they send it in a header or prepend it to the body IMHO it's very confusing to have examples of symmetric encryption where the key is sent along - sending a public key along with the message is fine. Not clear from the doc is if the public-key case is no longer supported - but if that is the case, there would be no need to send any key with the message, so the Crypto-Key will not be needed ? Again - I may miss something obvious here, is the value in the header just a reference to a pre-shared secret and not the actual secret ? But in this case - there is already the id in the binary header. Costin On Mon, Oct 31, 2016 at 9:54 AM Kari Hurtta <hurtta-ietf@elmme-mailer.org> wrote: > Costin Manolache <costin@gmail.com>: (Mon Oct 31 08:13:02 2016) > > 1. Why not add the Crypto-Key to the binary header ? If we have to deal > > with binary encoding, we can at > > least avoid parsing more text headers - and it doesn't have to be b64. > > This > > http://httpwg.org/http-extensions/encryption-preview.html#introduction > > | For example, it might be necessary to store a file on a server without > exposing its contents > | to that server. Furthermore, that same file could be replicated to other > servers (to make it > | more resistant to server or network failure), downloaded by clients (to > make it available > | offline), etc. without exposing its contents. > > does not mention it, but I think that there was hidden > (for this draft) motivation where reponse headers was > served from originin server via https (that include > Crypto-Key) but actual payload is served from another > server. That content-encryption provides encryption > for that payload. Another Content-Encoding (Out-Of-Band) > moves payload to other server. > > > https://greenbytes.de/tech/webdav/draft-reschke-http-oob-encoding-08.html#rfc.section.3.5.3 > > was mentioned. > > / Kari Hurtta > >
- Encryption simplification Martin Thomson
- Re: Encryption simplification Julian Reschke
- Re: Encryption simplification Poul-Henning Kamp
- Re: Encryption simplification Kari Hurtta
- Re: Encryption simplification Martin Thomson
- Re: Encryption simplification Costin Manolache
- Re: Encryption simplification Willy Tarreau
- Re: Encryption simplification Martin Thomson
- Re: Encryption simplification Kari Hurtta
- Re: Encryption simplification Costin Manolache
- Re: Encryption simplification Kari Hurtta
- Re: Encryption simplification Mark Nottingham
- Re: Encryption simplification Julian Reschke