Re: [openpgp] Remove email metadata by encrypting headers using the published DKIM key

[Michael Richardson <[e-mail]>]

Kai Engert <[e-mail]> wrote:
    > On 23.06.22 10:45, Tobias Mueller wrote:
    >> I guess the changes your idea brings are big enough to warrant a
    >> separate DKIM-like mechanism, maybe a "DomainKeys Encrypted Mail" (DKEM)
    >> that works about the same as DKIM.

    > I like the acronym DKEM. However, I'd rather define the M in DKEM as
    > "Metadata", not Mail, because this isn't about encrypting all of the
    > mail, only some of the headers.


    >> Compared to DKIM, though, the recipient server cannot process mails when
    >> the key is not available (or a wrong key is used) which seems like a
    >> rather big obstacle.

    > True, it would be required to demand that a sending agent checks the key
    > source (e.g. DNS) right before sending it, to ensure the key information
    > is fresh.

Why would the recipient server be unable to process the email?
The To:/CC: headers are *NOT* used at the SMTP layer.

The recipient server could well receive the email, queue it, and then decrypt
it later.

This could probably be prototyped using the milter interfaces that both
postfix and sendmail use, and those mostly look like a pass through an
auxiliary server.  (opendkim does the same thing)
If the auxiliary server is unavailable, then the email stays in the Q.


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide