Re: [lamps] Draft addition of header protection to the LAMPS charter

Hi DKG, Russ et al.

I think we need to include what's the current situation with this 
issue, in particular mention that there is a solution in on Standards 
Track already (RFC5751). How about something like this:

--- BEGIN ---

7. Cryptographic protection of electronic mail headers: RFC5751 defines a 
mechanism that is somewhat underspecified and thus not widely implemented. 
Most current implementations of cryptographically-protected electronic 
mail protect only the body of the message - but not the header part - 
which leaves significant room for attacks on otherwise-protected messages. 
The WG shall improve the specification to cryptographic protection of 
email-headers (both for integrity and encryption) to close significant 
privacy, security and usability gaps in cryptographically-protected 
electronic mail.

--- END ---

cheers
  Bernie

--

http://ucom.ch/
Modern Telephony Solutions and Tech Consulting for Internet Technology

On Thu, 3 Jan 2019, Russ Housley wrote:

> At the LAMPS session in Bangkok, there was interest in adding a header
> protection work item to the charter.  Alexey talked about this in Montreal,
> and he posted a draft a few weeks ago:
>
> 	draft-melnikov-lamps-header-protection.
>
> Several people said that they would implement a solution if the LAMPS WG
> produced an RFC on this topic.
>
> Shortly before the holidays, DKG proposed charter text:
>
>> 7. Specify a mechanism for the cryptographic protection of e-mail
>> headers.  Most current implementations protect only the body of the
>> message, which leaves significant room for attacks against
>> otherwise-protected messages.  Cryptographic protection (both for
>> signatures and encryption) which applies to the headers in conjunction
>> with the message body are necessary to close significant security and
>> usability gaps in cryptographically-protected electronic mail.
>
> Does anyone have any concerns with this text?  If not, we will ask the
> Security ADs to add this to the existing charter.
>
> Russ
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>