Re: [lamps] On the need for standardization of software-based interoperable private keys [was: Re: draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)]

[Bernie Hoeneisen <[e-mail]>]

Hi,

On Thu, 5 Aug 2021, Daniel Kahn Gillmor wrote:

> However, i don't understand how interoperation for private keys is
> nonsense.
>
> Many people with e-mail accounts use multiple mail user agents to access 
> the same account (e.g. one MUA on their phone, another on a laptop). 
> If those accounts are supposed to be able to use end-to-end secure 
> communication then at least one of them needs to be able to export its 
> private key material and the other needs to be able to import it. [...] 
> if we want to ensure that end-to-end cryptographic protections are 
> usable and secure for actual e-mail users, then we need to figure out 
> the interop issues for private key material. [...]

For those interested in private key exchange technology: For the use case 
mentioned above, there are already several implementations (pEp KeySync) 
[1], which is working in an e2e manner; however these implementations are 
currenty PGP based (i.e. S/MIME is not yet suported).

We documented the pEp KeySync protocol in:

   https://datatracker.ietf.org/doc/html/draft-pep-keysync

cheers,
  Bernie


[1] https://pep.foundation/pep-software/index.html (last section)