Re: [perpass] Another mail-related proposal

[Jim Fenton <[e-mail]>]

On 08/19/2013 10:27 PM, Randy Bush wrote:
>>> smtp is hop by hop.  just because A encrypts to B, A has zero assurance
>>> that B encrypts to C.  hence, e2e encryption is pretty much mandatory
>>> against a purely passive attacker.
>> ...which goes back to the original thing I was suggesting: that A should
>> be able to signal to B that it should only relay the message (e.g., to
>> C) if the channel is also encrypted and that C also will observe the
>> restriction if it needs to relay the message further.
> and A trusts B and B's software and configuration why?  transport
> encryption by default good.  e2e encryption by default gooder.  both
> great.
>
A trusts B and B's software and configuration for the same reasons it's
willing to send a message to B at all.  Usually either because B acts on
behalf of A as an outgoing MTA, or because the recipient has designated
B to receive mail (directly or indirectly) for them.  It's not a huge
stretch from there for A to trust B to get the transport encryption
right too.

I agree on the good/gooder/great scale.  But sometimes the best we can
do is "good".

-Jim