Re: [openpgp] Put Signature in an Email's Header

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Sat, 19 December 2020 00:56 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A14B03A0A08 for <openpgp@ietfa.amsl.com>; Fri, 18 Dec 2020 16:56:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b=GE6HDVOW; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b=KNm6YXIs
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qs3CHdes0p-a for <openpgp@ietfa.amsl.com>; Fri, 18 Dec 2020 16:56:10 -0800 (PST)
Received: from che.mayfirst.org (che.mayfirst.org [IPv6:2001:470:1:116::7]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B61B3A09F9 for <openpgp@ietf.org>; Fri, 18 Dec 2020 16:56:10 -0800 (PST)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1608339368; h=from : to : cc : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=8vkVaVSjBQ8GR0SWD/cbVzq+DMiLkIsKNaCya4xqMUw=; b=GE6HDVOW2nfu37etw87wSN3lxaEfU3iZyHBXd9rK6fbU8IR79YemKpdIfxLzrT1hv6C8H n4WMEm0MPxCZB57Dg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1608339368; h=from : to : cc : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=8vkVaVSjBQ8GR0SWD/cbVzq+DMiLkIsKNaCya4xqMUw=; b=KNm6YXIsF7COUr3JhLNzZ4NQBGqH6QoNZ0nYqlOU7CvPSe+kc07qBFvEhzuIL4Tzcj9/d pPWKy0sugKiST2MhDjmOnw8VmNu0J2H7dNF75olj7XoYEY7klErYqPyGgRADmjSad0OmeS6 Erea7XdMUyZSRRLflltaMEqrQPH1fnrlITOB4nKk1ryhUaRRR7owRhCXvcMDvlb3fqlHvbj jvr3+ydmkLUsEMN0RlTHeyCb1jdBlyCnLHKl/+OcKRZICsbYSqM7tUqIfiDkcQsKZWz3Wdk xg0pJr1whaiWPF/XqX1y063Q3Hfi0Fre9DwsaQ5+uZmiKfAxdaGXsgGMZ5tw==
Received: from fifthhorseman.net (unknown [108.58.6.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id 66934F9A6; Fri, 18 Dec 2020 19:56:08 -0500 (EST)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 137342010F; Fri, 18 Dec 2020 18:53:20 -0500 (EST)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Bart Butler <bartbutler@protonmail.com>, Kai Engert <kaie@kuix.de>
Cc: openpgp@ietf.org, "Neal H. Walfield" <neal@walfield.org>, Wiktor Kwapisiewicz <wiktor=40metacode.biz@dmarc.ietf.org>
In-Reply-To: <vqoCUg721G-eauS6pfk-7eRNPP5S4PAgQmPuoPJ8mBqvSu9YKxZHPbSlQqV9l6SBhF6uJCzFej1GLZHQzRR3xnW8F4jbQACRIqO6lQYp18M=@protonmail.com>
References: <48be3fcf-cdce-9ef4-655b-63b6dddf9310@kuix.de> <20201211095836.5218a72e@computer> <cd02d2db-0671-dfc0-dab3-dc793a2c1605@metacode.biz> <878sa4y7hy.wl-neal@walfield.org> <8dd0976f-f85d-66ed-489f-98fdacf8cf82@kuix.de> <vqoCUg721G-eauS6pfk-7eRNPP5S4PAgQmPuoPJ8mBqvSu9YKxZHPbSlQqV9l6SBhF6uJCzFej1GLZHQzRR3xnW8F4jbQACRIqO6lQYp18M=@protonmail.com>
Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEXEK/AhYJKwYBBAHaRw8BAQdAr/gSROcn+6m8ijTN0DV9AahoHGafy52RRkhCZVwxhEe0K0Rh bmllbCBLYWhuIEdpbGxtb3IgPGRrZ0BmaWZ0aGhvcnNlbWFuLm5ldD6ImQQTFggAQQIbAQULCQgH AgYVCgkICwIEFgIDAQIeAQIXgAIZARYhBMS8Lds4zOlkhevpwvIGkReQOOXGBQJd5Hw3BQkFpJWB AAoJEPIGkReQOOXGDYEA/j0ERjPxDleKMZ2LDcWc/3o5cLFwAVzBKQHppu0Be5IWAP0aeTnyEqlp RTE7M8zugwkhYeUYfYu0BjecDUMnYz6iDLgzBF3kewUWCSsGAQQB2kcPAQEHQK1IuW0GZmcrs2mx CYMl8IHse0tMF8cP7eBNXevrlx2ZiPUEGBYIACYCGwIWIQTEvC3bOMzpZIXr6cLyBpEXkDjlxgUC XeR7TwUJAiGl/gCBdiAEGRYIAB0WIQQsv6x2UaqQJzY+dXHEDyVUMvKBDwUCXeR7BQAKCRDEDyVU MvKBD7KmAQCHs+7588C4jto6fMje0Nu97zzoppjJM7lrGF2rVnbHvwD+MgmGUbHzPSUrTWnZBQDi /QM595bxNrBA4N1CiXhs2AMJEPIGkReQOOXGpp0BAM7YeBnt/UNvxJAGm4DidSfHU7RDMWe6Tgux HrH21cDkAQC9leNFXJsQ7F2ZniRPHa8CkictcQEKPL8VCWpfe8LbArg4BF3ke5wSCisGAQQBl1UB BQEBB0Cf+EiAXtntQMf51xpqb6uZ5O0eCLAZtkg0SXHjA1JlEwMBCAeIfgQYFggAJhYhBMS8Lds4 zOlkhevpwvIGkReQOOXGBQJd5HucAhsMBQkCIaVkAAoJEPIGkReQOOXGdYcBANYnW7VyL2CncKH1 iO4Zr0IwfdIv6rai1PUHL98pVi3cAP9tMh85CKGDa0Xi/fptQH41meollLW5tLb/bEWMuUNuBQ==
Date: Fri, 18 Dec 2020 18:53:19 -0500
Message-ID: <87sg82zn68.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/vK8GO0O7pGqDxoWshc4AgM6OMLk>
Subject: Re: [openpgp] Put Signature in an Email's Header
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 19 Dec 2020 00:56:12 -0000

On Fri 2020-12-11 12:19:23 +0000, Bart Butler wrote:

> Does signature.asc even show up as an attachment if you set the
> disposition to inline for PGP/MIME? That would be the obvious solution
> for suppressing unwanted signature.asc attachments for non-aware
> recipients.

Setting a MIME part as Content-Disposition: inline (RFC 2183) is
intended to encourage the recieving MUA to display the part inline to
the reader.

if the receiving MUA has no way of rendering the signature part
(Content-Type: application/pgp-signature), then there's no way that it
can actually render it "inline", so most MUAs will simply ignore the
Content-Disposition: inline header, rather than hiding the message part
entirely.

        --dkg