[openpgp] Re: Proposal for update to RFC3156 (PGP/MIME)

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2024-12-06 22:24:55 +0100, Kai Engert wrote:
> thanks, I'm interested in a solution that avoids rendering an unknown 
> attachment in naive clients.
[…]
> As I understand it, this approach wouldn't avoid the "unknown attachment".

I think you're correct about the proposal here, Kai.  It doesn't address
the problem you're describing.

I suspect if you want to devise a format for e2e-signed-only mail (not
encrypted or encrypted+signed) that doesn't have the "unknown
attachment" concern in naive clients, a reasonable approach would be to
piggyback on the DKIM specification:

Define a new header field that works the same way as DKIM in terms of
canonicalization of the signed data stream, and semantics of a failed
signature (failedsig == nosig), but without reference to the signing
keys in the DNS -- rather, the cryptographic material used to verify the
signature would be taken from the e2e sender's OpenPGP certificate.  The
simplest approach would be to have the specification take no position on
how to locate or retrieve the OpenPGP certificate, and leave that to
approaches like Autocrypt, WKD, etc.

I don't know whether that work would be in-scope for the OpenPGP working
gorup, but it would probably be something we could aim for in LAMPS, as
it's very much in line with the work in
draft-ietf-lamps-e2e-mail-guidance that aims to make usable and
non-obtrusive e2e cryptography in e-mail.

              --dkg