Re: [lamps] Header Protection, summary of my today's suggestion

Thanks Bernie.

I think the next step is for the authors update the draft to reflect his way forward (or whatever recommend that comes from a sided discussion).

Russ

> On Nov 8, 2021, at 2:44 PM, Bernie Hoeneisen <bernie@ietf.hoeneisen.ch> wrote:
> 
> Dear LAMPS WG
> 
> As requested I am trying to summarize my suggestion for a compromise to deblock the discussions on the Header Protection Draft. https://datatracker.ietf.org/doc/draft-ietf-lamps-header-protection/
> 
> 
> Background:
> 
> Over the last time we assessed pro and cons of the two proposals "wrapped" (current S/MIME Standard) and "injected" (an alternative) header protection schemes; (the latter with two variants, adding "Legacy Display" variant for signed&encrypted).
> 
> 
> IMHO the summary on the results of the assessment was roughly:
> 
> - None of the protection schemes is clearly superior to the others
> 
> - In Signed&Encrypted case the "wrapped" scheme clearly prevails
> 
>  - While with the "wrapped" scheme some clients require opening an
>    attachment, with the "injected" scheme all assessed clients do NOT
>    render ANY subject. The "legacy display" improves the situation
>    with some clients, but makes things much worse with Outlook.
> 
> - In Signed-Only there is a difference between S/MIME aware and
>  non-S/MIME aware clients
> 
>  - For S/MIME aware clients there is no clear "winner". (With the
>    "wrapped" scheme some clients require opening an attachment, while
>    with "injected" scheme all assessed clients can not render the
>    protected subject (unprotected subject only).
> 
>  - For S/MIME unaware legacy clients in certain cases, it seems more
>    likely that the messages can be rendered with the "injected" scheme
>    using multipart (however also with the unprotected Subject only)
>    compared to the "wrapped" scheme. (Note: This aspect was not assessed
>    thoroughly)
> 
> In short: The only case, where the "injected" scheme seems to a better choice than the currently standardized "wrapped" scheme is for signed-only messages sent to with S/MIME unaware clients.
> 
> For more complete information, please refer to the streams of LAMPS@IETF-111 (July 2021).
> 
> 
> My Sugggestion:
> 
> - Keep the "wrapped" header protection scheme as the default in the S/MIME standard for all cases.
> 
> - Provide clear instructions to help implementors on how to update S/MIME clients that still need the reader to click on the attachment to render a wrapped message.
> 
> - Allow "injected" as an option for the case "Signed-Only & multipart", to provide a mechanism for sending-clients to help S/MIME unaware receiving-clients to render the message.
> 
> 
> Note:
> 
> Fixing clients to automatically render "wrapped" messages is a fairly easy and straight-forward change. Clients like Apple-Mail or Thunderbird do this already, while for Outlook there is a Plugin implementing such a rendering functionality for pEp (cf. https://pep.software/outlook/ ).
> 
> Hope that helps and that I did not leave out important information in an attempt to keep this summary shortish.
> 
> All the best,
> Bernie
> 
> 
> --
> 
> http://ucom.ch/
> Modern Telephony Solutions and Tech Consulting for Internet Technology
> 
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm