Re: the introduction problem, was Email and reputation (was Re: Service outages planned for April 25)

[Keith Moore <[e-mail]>]

On 5/3/22 00:46, Viktor Dukhovni wrote:

>> When there are multiple barriers to solving a problem, any one of those problems can become an excuse to avoid solving the other problems.
> Key distribution and discovery isn't the fatal problem, the fatal problem
> is that encrypted email is unusable once received and stored.
>
> Until encrypted email is usable (**search**, long-term signature validation,
> personal private key rollover, ...), all the key distribution tech in the
> world won't make it worth adopting.

I wouldn't call such email entirely unusable, but clearly a system is 
more usable (for some meaning of "usable") if encrypted emails can be 
searched and signed emails can be verified long after such emails are 
received.

I could take a stab at these problem and say that a message can be 
decrypted and/or its signature verified when read (assuming of course 
that the message is read a short time after it is sent, when the signing 
keys and associated certs are still valid), and save their own signature 
for the message ("message X was verified to be signed by Y by MUA Z on 
<date>".   That's still nowhere nearly perfect, e.g. it might not hold 
up in court as evidence that the sender of the message did or did not 
say something.   But it's probably good enough for the recipient, for 
most purposes, and still better than the situation we have today where 
we have no widespread encryption or signing for emails.

(I think in that case the problem devolves to that of long term key 
storage for the recipient, which is admittedly a difficult problem by 
itself.)

But that's just an example.   I don't want to dismiss the problem or 
claim that it's solved with a wave of the hand.

Perhaps a useful next step would be to try to list the problems 
associated with signed and/or encrypted email.   Then any proposal could 
describe which of those problems it attempts to address, and how.

Keith