Re: [pkix] [smime] Key lookup service via draft-bhjl-x509-srv-00

["John Levine" <[e-mail]>]

>> Right.  When you come up with a way for my MUA to fetch a key from 
>> your MUA when you have never sent me a message, let us know. 
>
>Is it possible that you're both using the wrong term above?  E.g. MTA vs 
>MUA?

No, this is the classic mail crypto model from the 1990s.  The
endpoints know the secrets, the intermediate nodes aren't trustworthy.
We are all familiar with vast popularity of crypto schemes that work
this way like, um, and er.

>I would expect it might be possible for a user to arrange to have its 
>inbounds MTA configured with some amount of data related to the user's 
>delivery email address, and I would also expect that such data could be 
>retrieved from the MTA by an MUA wanting to send email to that delivery 
>email address.

That's what DEEP does.  It has the practical problem that due to the
plague of botnet spam, most MUAs can't directly talk to remote MTAs,
only to their local MSA, so it needs a kludge to proxy the retrieval
MUA->MSA->remote MTA->MSA->MUA.  One of the reasons we wrote our draft
is that it does the lookups over https, which most MUAs already know
how to do.

R's,
John