Re: [openpgp] Put Signature in an Email's Header

[Bart Butler <[e-mail]>]

Why not take a page out of DKIM’s book and just put the signature header(s) in the protected headers directly, maybe at the top, except exclude only that header from the signed data if present? Seems like that would also be backwards compatible with existing PGP/MIME if you wanted to sign both ways as well.

On Tue, Aug 8, 2023 at 4:08 PM, Kai Engert <[e-mail]> wrote:

On 08.08.23 12:13, Werner Koch wrote:
> A signed mail with the signing key included (as done by CMS) is a
> straightforward way to bootstrap encrypted communication. It is mail
> standards compliant and does not break when for example forwarding
> mails.

Good point about forwarding, I didn't consider that previously. And I
realize we also need to ensure that we don't break protected headers.

To investigate, I crafted a message without a multipart/signed layer,
but with a protected header layer. I looked at this message in two
different webmail clients, and that layer wasn't rendered.

This brings me to the following idea: Could we transport that new
signature-header in the header area of an additional multipart/mixed layer?

Example message:

MIME-Version: 1.0
Subject: wrapped in two multipart/mixed, prot hdr and sig
Content-Type: multipart/mixed; boundary="signature";
openpgp-signature="multi-mixed"
Header-Signature: micalg=pgp-sha256;
protocol="application/pgp-signature"; sigdata=
wsF5BAABCAAjFiEEIdFuZ...
=9HqM

--signature
Content-Type: multipart/mixed; boundary="prot-hdr";
protected-headers="v1"
From: Kai Engert <[e-mail]>
To: test <[e-mail]>
Subject: wrapped in two multipart/mixed, prot hdr and sig

--prot-hdr
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

dHF3ZnF3ZWYNCg==

--prot-hdr--

--signature--

When I use forward-as-attachment in Thunderbird with a message of this
structure, the "Header-Signature" header is kept.

Could this work?

Thanks
Kai

_______________________________________________
openpgp mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/openpgp