Re: [lamps] LAMPS sample keys and certificates

[Russ Housley <[e-mail]>]

A comment about Section 8.6:  Triple-Wrapping was never envisioned as a mechanism for integrity protection of mail header.  Rather, when a mail list agent is involved, the outermost signature is applied by the mail list agent to protect the mail list expansion history.  This history is needed to detect loops.

Russ


> On Dec 20, 2019, at 6:48 PM, Daniel Kahn Gillmor <[e-mail]> wrote:
> 
> Hi LAMPS folks--
> 
> On Thu 2019-12-19 18:32:28 -0500, Russ Housley wrote:
> 
>> We set a goal at IETF 106 of learning how different user agents handle
>> the two approaches to header protection.  I would like to see reports
>> on the mail list so that we can choose a way forward.  Please help!
> 
> Thanks for the nudge, Russ.  Turns out i've learned a lot more about
> S/MIME than i ever wanted to know, in the process of creating S/MIME
> test vectors for the Autocrypt-style protected headers.
> 
> I've just published
> https://www.ietf.org/id/draft-autocrypt-lamps-protected-headers-02.html
> 
> From the in-document changelog:
> 
> 
>    Significant changes between version -01 and -02:
> 
>      - Added S/MIME test vectors in addition to PGP/MIME
> 
>      - Legacy Display parts should now be text/plain and not
>        text/rfc822-headers (see
>        https://github.com/autocrypt/protected-headers/issues/23)
> 
>      - Cryptographic Payload must have protected-headers parameter set
>        to v1 (see
>        https://github.com/autocrypt/protected-headers/issues/21)
> 
>      - Test vector sample Message-Ids have been normalized
> 
>      - Added encrypted-only (unsigned) test vectors, at the suggestion of
>        Russ Housley
> 
> In addition, the test vectors are programmatically available at:
> 
>    imap://[e-mail]/inbox
> 
> (use any password, should be a read-only mailbox, with ephemeral IMAP
> tags)
> 
> I'm asking folks who have clients capable of handling cryptographic
> e-mail (either S/MIME or PGP/MIME or both, you don't have to handle
> everything!) to submit screenshots!
> 
> It should be useful to collect screenshots following the guidance
> outlined here:
> 
>    https://github.com/autocrypt/protected-headers/tree/master/screenshots
> 
> If you'd an example, take a look at the Thunderbird + Enigmail
> screenshots here:
> 
>    https://github.com/autocrypt/protected-headers/tree/master/screenshots/thunderbird%2Benigmail/68.3.1%2B2.1.3
> 
> I'd appreciate any feedback about this work, particularly on:
> 
> - the screenshot process (can we make it easier for people to generate
>   screenshots from a given client)?
> 
> - the test vectors themselves (are problems with any of them? do they
>   follow the draft correctly?)
> 
> - the text in the draft (as an implementer, is it easy to understand
>   and implement)?
> 
> Regards,
> 
>        --dkg