Re: [lamps] LAMPS sample keys and certificates

[Daniel Kahn Gillmor <[e-mail]>]

Hi LAMPS folks--

On Thu 2019-12-19 18:32:28 -0500, Russ Housley wrote:

> We set a goal at IETF 106 of learning how different user agents handle
> the two approaches to header protection.  I would like to see reports
> on the mail list so that we can choose a way forward.  Please help!

Thanks for the nudge, Russ.  Turns out i've learned a lot more about
S/MIME than i ever wanted to know, in the process of creating S/MIME
test vectors for the Autocrypt-style protected headers.

I've just published
https://www.ietf.org/id/draft-autocrypt-lamps-protected-headers-02.html

From the in-document changelog:


    Significant changes between version -01 and -02:

      - Added S/MIME test vectors in addition to PGP/MIME

      - Legacy Display parts should now be text/plain and not
        text/rfc822-headers (see
        https://github.com/autocrypt/protected-headers/issues/23)

      - Cryptographic Payload must have protected-headers parameter set
        to v1 (see
        https://github.com/autocrypt/protected-headers/issues/21)

      - Test vector sample Message-Ids have been normalized

      - Added encrypted-only (unsigned) test vectors, at the suggestion of
        Russ Housley

In addition, the test vectors are programmatically available at:

    imap://[e-mail]/inbox

(use any password, should be a read-only mailbox, with ephemeral IMAP
tags)

I'm asking folks who have clients capable of handling cryptographic
e-mail (either S/MIME or PGP/MIME or both, you don't have to handle
everything!) to submit screenshots!

It should be useful to collect screenshots following the guidance
outlined here:

    https://github.com/autocrypt/protected-headers/tree/master/screenshots

If you'd an example, take a look at the Thunderbird + Enigmail
screenshots here:

    https://github.com/autocrypt/protected-headers/tree/master/screenshots/thunderbird%2Benigmail/68.3.1%2B2.1.3

I'd appreciate any feedback about this work, particularly on:

 - the screenshot process (can we make it easier for people to generate
   screenshots from a given client)?

 - the test vectors themselves (are problems with any of them? do they
   follow the draft correctly?)

 - the text in the draft (as an implementer, is it easy to understand
   and implement)?

Regards,

        --dkg