From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Andrey Jivsov <openpgp@brainhub.org>, "openpgp@ietf.org" <openpgp@ietf.org>
Thread-Topic: [openpgp] Can the OpenPGP vs. S/MIME situation be fixed?
Thread-Index: AQHR050jpR81NF3KlE2UhFa6MyYJKaAGlDWAgAEQVZj//z2nAIAAy69z
Date: Mon, 4 Jul 2016 04:14:39 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4CB9814@uxcn10-5.UoA.auckland.ac.nz>
References: <20160701153304.332d2c95@pc1>,
 <874m86xq04.fsf@alice.fifthhorseman.net>
 <9A043F3CF02CD34C8E74AC1594475C73F4CB97D2@uxcn10-5.UoA.auckland.ac.nz>,
 <5779E086.9000506@brainhub.org>
In-Reply-To: <5779E086.9000506@brainhub.org>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/8luhIMfoYIYvuSxCT7bN2IyzX-8>
Subject: Re: [openpgp] Can the OpenPGP vs. S/MIME situation be fixed?
Precedence: list

Andrey Jivsov <openpgp@brainhub.org> writes:=0A=
=0A=
>One issue with storing OpenPGP KeyID in X.509 Subject Key Identifier (SKI)=
 is=0A=
>that over the last decade and earlier popular S/MIME clients were not usin=
g=0A=
>SKI to identify a recipient. Instead, they were using the X.509 cert's Iss=
uer=0A=
>and SN. Therefore, one will have to encode OpenPGP keyID into the SN of th=
e=0A=
>X.509 cert to be able to locate the OpenPGP key later from the encrypted=
=0A=
>S/MIME message. This works if the ecosystem owns an issuing X.509 Sub-CA, =
so=0A=
>that it's possible to control the SNs.=0A=
=0A=
We'd really need to get more data on what can handle sKID, since in my case=
=0A=
the use is all closed environments (banking, embedded, SCADA, etc) it's eas=
y=0A=
enough to simply specify that the implementation needs to support sKID but=
=0A=
there's no current data (that I know of) on general support.  In any case I=
=0A=
think getting a small number of implementations to support sKID is going to=
 be=0A=
vastly easier than asking CAs to put PGP IDs into certs.=0A=
=0A=
In any case it doesn't cost anything to put the sKID/iAndS details into the=
=0A=
spec, and if you want it you've at least got an interoperable way of doing =
it.=0A=
=0A=
Peter.=0A=