IETF Logo Mail Archive

Re: [lamps] I-D Action: draft-ietf-lamps-header-protection-10.txt

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Tue, 10 January 2023 16:11 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A42ACC09CCE9 for <spasm@ietfa.amsl.com>; Tue, 10 Jan 2023 08:11:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.095
X-Spam-Level:
X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b="rntD+KBM"; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b="d+M1N63B"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LGgJ9LzLvwlx for <spasm@ietfa.amsl.com>; Tue, 10 Jan 2023 08:11:37 -0800 (PST)
Received: from che.mayfirst.org (che.mayfirst.org [IPv6:2001:470:1:116::7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4AF84C09CD0D for <spasm@ietf.org>; Tue, 10 Jan 2023 08:11:37 -0800 (PST)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1673367091; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=9hLh19x0mYNysR6WcfP7GXcBjHvrjsEYPDuIZ/xpH4k=; b=rntD+KBMOsMzKModGoUx8yVBFqDYf84XSncRp0+FRuxjJKR31Xyj2AYIAW031tQVIiYgp QuFwAyPlpUTjWERAw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1673367091; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=9hLh19x0mYNysR6WcfP7GXcBjHvrjsEYPDuIZ/xpH4k=; b=d+M1N63BRQ5vOdD90ogfFtDmKjICblafQCPTdETfsr4d3LSeECWyiQQ4lpGX5IKe5vuG4 gTIbFJ7gokGtPGC+pdbqFfxbupAQLO8o6oA+NNC5Z8wGIKp4VP9OD9Z3gAteAoFGB1ItBpk RqRXLMydBXfb9BRFHekXBVGlQBl3KpFSF+4j4Scn3w/58yBjE2/yaCf3wYK0oas6ESNLWqL F4e610yk6o03XutJciAZ7x5tzYI7Q/IOQi7F9HV5chdCq/Q4s+HN8CCkWXAOS45iwmlVzvX ezNiWgOJXstvNFjR1oEzWbe1YY2jYrmq4wkWvJbBiCVct82oj49SxE4mIYKw==
Received: from fifthhorseman.net (lair.fifthhorseman.net [108.58.6.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id E124FF9AD for <spasm@ietf.org>; Tue, 10 Jan 2023 11:11:31 -0500 (EST)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 03BF1204FD; Tue, 10 Jan 2023 11:11:26 -0500 (EST)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: LAMPS <spasm@ietf.org>
In-Reply-To: <2DD12DD2-F92B-4C22-B8C2-B6728D16502A@vigilsec.com>
References: <167158132346.30562.10162999394367899551@ietfa.amsl.com> <2DD12DD2-F92B-4C22-B8C2-B6728D16502A@vigilsec.com>
Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEX+i03xYJKwYBBAHaRw8BAQdACA4xvL/xI5dHedcnkfViyq84doe8zFRid9jW7CC9XBiI0QQf FgoAgwWCX+i03wWJBZ+mAAMLCQcJEOCS6zpcoQ26RxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNl cXVvaWEtcGdwLm9yZ/tr8E9NA10HvcAVlSxnox6z62KXCInWjZaiBIlgX6O5AxUKCAKbAQIeARYh BMKfigwB81402BaqXOCS6zpcoQ26AADZHQD/Zx9nc3N2kj13AUsKMr/7zekBtgfSIGB3hRCU74Su G44A/34Yp6IAkndewLxb1WdRSokycnaCVyrk0nb4imeAYyoPtBc8ZGtnQGZpZnRoaG9yc2VtYW4u bmV0PojRBBMWCgCDBYJf6LTfBYkFn6YAAwsJBwkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3Rh dGlvbnMuc2VxdW9pYS1wZ3Aub3JnL0Gwxvypz2tu1IPG+yu1zPjkiZwpscsitwrVvzN3bbADFQoI ApsBAh4BFiEEwp+KDAHzXjTYFqpc4JLrOlyhDboAAPkXAP0Z29z7jW+YzLzPTQML4EQLMbkHOfU4 +s+ki81Czt0WqgD/SJ8RyrqDCtEP8+E4ZSR01ysKqh+MUAsTaJlzZjehiQ24MwRf6LTfFgkrBgEE AdpHDwEBB0DkKHOW2kmqfAK461+acQ49gc2Z6VoXMChRqobGP0ubb4kBiAQYFgoBOgWCX+i03wWJ BZ+mAAkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jnfvo+ nHoxDwaLaJD8XZuXiaqBNZtIGXIypF1udBBRoc0CmwICHgG+oAQZFgoAbwWCX+i03wkQPp1xc3He VlxHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnaheiqE7Pfi3Atb3GGTw+ jFcBGOaobgzEJrhEuFpXREEWIQQttUkcnfDcj0MoY88+nXFzcd5WXAAAvrsBAIJ5sBg8Udocv25N stN/zWOiYpnjjvOjVMLH4fV3pWE1AP9T6hzHz7hRnAA8d01vqoxOlQ3O6cb/kFYAjqx3oMXSBhYh BMKfigwB81402BaqXOCS6zpcoQ26AADX7gD/b83VObe14xrNP8xcltRrBZF5OE1rQSPkMNy+eWpk eCwA/1hxiS8ZxL5/elNjXiWuHXEvUGnRoVj745Vl48sZPVYMuDgEX+i03xIKKwYBBAGXVQEFAQEH QIGex1WZbH6xhUBve5mblScGYU+Y8QJOomXH+rr5tMsMAwEICYjJBBgWCgB7BYJf6LTfBYkFn6YA CRDgkus6XKENukcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcEAx9vTD3b J0SXkhvcRcCr6uIDJwic3KFKxkH1m4QW0QKbDAIeARYhBMKfigwB81402BaqXOCS6zpcoQ26AAAX mwD8CWmukxwskU82RZLMk5fm1wCgMB5z8dA50KLw3rgsCykBAKg1w/Y7XpBS3SlXEegIg1K1e6dR fRxL7Z37WZXoH8AH
Date: Tue, 10 Jan 2023 11:11:25 -0500
Message-ID: <87wn5u8j4i.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/L-LDYnCxM7begBHIERkSNOMSEQg>
Subject: Re: [lamps] I-D Action: draft-ietf-lamps-header-protection-10.txt
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Jan 2023 16:11:41 -0000

On Wed 2022-12-21 12:43:08 -0500, Russ Housley wrote:
> Section 2.3.2: s/header field name name/header field name/
>
> Section 2.5.8.1 says:
>
>    When crafting the headers for a reply message, the composing MUA can
>    make use of the reference message's HP-Removed and HP-Obscured
>    headers (from within the cryptographic envelope) to ensure that
>    headers derived from the reference message do not leak in the reply.
>
> I suggest a small rewording:
>
>    When crafting the headers for a reply message, the composing MUA can
>    make use of the HP-Removed and HP-Obscured headers from within
>    the cryptographic envelope of the reference message to ensure that
>    headers derived from the reference message do not leak in the reply.

Thanks for the review, Russ!

These have been fixed in git and will be part of the next released
version.

        --dkg

v2.43.4 | Report a Bug | By Email | System Status