Re: [lamps] S/MIME fix

[Adam Roach <[e-mail]>]

On 5/16/18 4:16 PM, Stephen Farrell wrote:
> - Designs pre-date web user agent which changes trust model
> (where's the private key kept? Needs new infrastructure)


To understand the challenges surrounding what you suggest, you probably 
want to study the issues surrounding isolated media streams in WebRTC. 
Start by looking at section 4.3.2.4 of draft-ietf-rtcweb-security, and 
then read through <https://www.w3.org/TR/webrtc/#isolated-media-streams>.

To create an analogous situation for secure email, you'd need to use 
webcrypto in a way that stored your private key in the browser 
(inaccessible to the page), and develop web standards that add some 
affordance for web pages to hand encrypted data to the browser in a way 
that causes the corresponding unencrypted data to be displayed to the 
user, but isolated from the web page completely (e.g., rendered into an 
iframe that the parent cannot inspect).

Whether that kind of isolated context for email (which should be usable 
for real-time messaging as well, if done correctly) is reasonable or too 
clunky to work is yet to be seen. (I've had a few conversations that 
concluded "too clunky," but reasonable people may disagree.) In any 
case, the bulk of the work for that kind of system would need to take 
place in the W3C.

There are, of course, possible trade-offs to be made in which the user 
trusts the web-hosted mail service with access to message plain text, or 
even to their private key; but once you take that leap, you're doing 
scantly better than the hop-by-hop security provided by DANE and/or MTA-STS.

/a