Re: [lamps] Draft addition of header protection to the LAMPS charter

[Daniel Kahn Gillmor <[e-mail]>]

On Mon 2019-01-07 09:38:25 +0100, Bernie Hoeneisen wrote:
> What I remember from this basic websearch: In S/MIME isode, rebex, and a 
> couple of others (I don't remember the names anymore) appeared to 
> have implemented (full or partial) support for S/MIME version 3.1 / 3.2 
> Header Protection.

Isode is the implementation i was aware of.

Can you point me to the rebex implementation?  I see:

  https://www.rebex.net/secure-mail.net/features/s-mime.aspx

which says:

     Please note that only the message body is encrypted - everyone can
     still read the message headers such as From, To, Date or Subject.

If you could remember the names of the couple of others you found, or
dig them back up with another websearch, that'd be great.

> Anyways, the total number of implementations is likely rather low.

yep, that seems to be the consensus on the list.

> Maybe others on this list have further information on the implementation 
> situation of Header Protection in S/MIME, which they may want to share 
> here.

agreed, that would be great.

> Outside the S/MIME world, I can refer to the four implementations that 
> support pEp (pretty Easy privacy). pEp is specified to perform Header 
> protection (almost) the same way as described in RFC 5751.

RFC 5751 doesn't cover anything outside of S/MIME, but i agree with you
-- i want whatever header protection LAMPS specifies to work for
PGP/MIME as well.  Can you explain what the "(almost)" means in the
paragraph above?

Are you talking about "pEp email format 1" or "pEp email format 2" of
https://pep.foundation/dev/repos/internet-drafts/file/tip/pep-email/draft-marques-pep-email.mkd
or are you talking about something else?

it doesn't look to me like either of those two formats specifically are
related to RFC 5751-style headers protection -- there's no mention of
message/rfc822 content-type in the text, or in the examples, and the
headers aren't positioned as headers, but instead they're included "as
the first line" of the body (which i confess i don't understand if the
Content-Type is anything other than text/plain).

Anyway, i don't mean to have the design discussion in this thread, i'm
just trying to gather information about what's actually implementing and
using RFC 5751, so we can determine how to represent it accurately in
the charter text (if we refer to it at all).

Can we settle on a single proposal?

        --dkg