Re: Why are mail servers not also key servers?

[Doug Royer <[e-mail]>]

On 04/20/2017 05:40 PM, Paul Wouters wrote:
> On Thu, 20 Apr 2017, Rui Costa wrote:
> 
>> So, can someone point me to some 
>> URL/documentation/https://mailarchive.ietf.org/arch/msg/ietf/xyz 
>> explaining the point on having keys/cryptography somewhere in between 
>> these 2 end points? (And thus i guess i'm saying i don't understand 
>> cryptography's point on scenarios other than what i think people have 
>> called on these threads "E2E".)
> 
> I want to send you an encrypted email. I need your key. I can send a
> plaintext email asking you for the key. I have to hope that it really
> reached you and that it is you who gave me the key and that the key
> was not modified in transport.
>

You send me a signed email from a mutually trusted source. I now have 
your public key, because you can extract it from the signed S/MIME 
email. (I am guessing you can do this with PGP.)

I can now send you an encrypted email, and it includes my public key, so 
you can decrypt it.

There are free email cert companies. This email is signed by one (unless 
the list server strips them out like it used to). Your MUA now knows my 
public key.

-- 

Doug Royer - (http://DougRoyer.US  http://goo.gl/yrxJTu )
[e-mail]
714-989-6135