Re: [lamps] LAMPS sample keys and certificates

[Russ Housley <[e-mail]>]

> On Dec 23, 2019, at 1:47 PM, Daniel Kahn Gillmor <[e-mail]> wrote:
> 
> On Mon 2019-12-23 11:29:51 -0500, Russ Housley wrote:
>> A comment about Section 8.6: Triple-Wrapping was never envisioned as a
>> mechanism for integrity protection of mail header.  Rather, when a
>> mail list agent is involved, the outermost signature is applied by the
>> mail list agent to protect the mail list expansion history.  This
>> history is needed to detect loops.
> 
> Thanks for the feedback, Russ.  I've actually heard people contemplating
> the use of triple-wrapping for providing cryptographic authenticity and
> integrity in a non-mail-list context as well, but i've hardly ever seen
> it used in practice.
> 
> If you have any suggested text amendments for this section, i'd be happy
> to incorporate your feedback.

I propose:

[RFC2634] defines "Triple Wrapping" as a means of providing cleartext signatures over signed and encrypted material.  A mail list agent uses triple wrapping to sign is the mail list expansion history. Others have observed that triple wrapping could be used in combination with the mechanism described in [RFC7508] to authenticate some headers for transport using S/MIME.

Russ