Re: [perpass] Mail encryption as an example

Russ Housley <housley@vigilsec.com> Sat, 17 August 2013 18:25 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: perpass@ietfa.amsl.com
Delivered-To: perpass@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 113C921F8EC3 for <perpass@ietfa.amsl.com>; Sat, 17 Aug 2013 11:25:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.567
X-Spam-Level:
X-Spam-Status: No, score=-102.567 tagged_above=-999 required=5 tests=[AWL=0.032, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HraPA7Tiqev5 for <perpass@ietfa.amsl.com>; Sat, 17 Aug 2013 11:25:51 -0700 (PDT)
Received: from odin.smetech.net (mail.smetech.net [208.254.26.82]) by ietfa.amsl.com (Postfix) with ESMTP id 7BE5311E81D9 for <perpass@ietf.org>; Sat, 17 Aug 2013 11:25:50 -0700 (PDT)
Received: from localhost (unknown [208.254.26.81]) by odin.smetech.net (Postfix) with ESMTP id 56B46F24038; Sat, 17 Aug 2013 14:25:58 -0400 (EDT)
X-Virus-Scanned: amavisd-new at smetech.net
Received: from odin.smetech.net ([208.254.26.82]) by localhost (ronin.smetech.net [208.254.26.81]) (amavisd-new, port 10024) with ESMTP id bY3j0aVHugQt; Sat, 17 Aug 2013 14:25:48 -0400 (EDT)
Received: from [192.168.0.8] (75-139-113-21.dhcp.mant.nc.charter.com [75.139.113.21]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 5549AF24032; Sat, 17 Aug 2013 14:25:56 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v1085)
Content-Type: text/plain; charset=us-ascii
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <520F63BC.7030808@gmail.com>
Date: Sat, 17 Aug 2013 14:25:46 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <7BCB3CC3-3E06-41F2-B2AE-CC8A697F45CF@vigilsec.com>
References: <520F63BC.7030808@gmail.com>
To: Yaron Sheffer <yaronf.ietf@gmail.com>
X-Mailer: Apple Mail (2.1085)
Cc: perpass@ietf.org
Subject: Re: [perpass] Mail encryption as an example
X-BeenThere: perpass@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "The perpass list is for discussion of the privacy properties of IETF protocols and concrete ways in which those could be improved. " <perpass.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/perpass>, <mailto:perpass-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/perpass>
List-Post: <mailto:perpass@ietf.org>
List-Help: <mailto:perpass-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/perpass>, <mailto:perpass-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Aug 2013 18:25:56 -0000

There is a technique for protecting the subject line for S/MIME, but the recipients MUST be exposed for the mail to b delivered.  This exposure can be limited to the clients and various mail servers if SMTP/POP/IMAP are run over TLS.

Russ


On Aug 17, 2013, at 7:51 AM, Yaron Sheffer wrote:

> Hi,
> 
> Stephen mentioned that S/MIME is not good enough because headers (to/from) are still exposed. But there's still tons of benefit when the content is encrypted, even if the metadata is exposed (provided users know that it is exposed, of course). E.g. I would like all my internal company email to be encrypted, even if tracing recipients is trivial for the attacker.
> 
> In other words, is the scope of the mailing list/solutions limited to security of individuals, as opposed to organizations?
> 
> From a deployment perspective, I think we know how to provide privacy ("identity protection") only by using heavyweight solutions, such as onion routing. But there's a whole lot of important things we could do (make S/MIME usable, standardize OTR, revive IPsec OE) if we remove this constraint. Are such items in scope of this discussion?
> 
> Thanks,
>    Yaron
> _______________________________________________
> perpass mailing list
> perpass@ietf.org
> https://www.ietf.org/mailman/listinfo/perpass