Re: [lamps] Draft addition of header protection to the LAMPS charter

Bernie:

I do not agree that it is underspecified, but I do agree that it is not widely implemented.  The presentation to the user is not specified at all, which is quite normal for IETF protocol specifications.

Also, S/MIME and OpenPGP offer signature and encryption.  With S/MIME 4.0, you can get authenticated-encryption.  In any case, I think that "signature and encryption" was a better description.

Russ

> On Jan 3, 2019, at 4:32 PM, Bernie Hoeneisen <bernie@ietf.hoeneisen.ch> wrote:
> 
> Hi DKG, Russ et al.
> 
> I think we need to include what's the current situation with this issue, in particular mention that there is a solution in on Standards Track already (RFC5751). How about something like this:
> 
> --- BEGIN ---
> 
> 7. Cryptographic protection of electronic mail headers: RFC5751 defines a mechanism that is somewhat underspecified and thus not widely implemented. Most current implementations of cryptographically-protected electronic mail protect only the body of the message - but not the header part - which leaves significant room for attacks on otherwise-protected messages. The WG shall improve the specification to cryptographic protection of email-headers (both for integrity and encryption) to close significant privacy, security and usability gaps in cryptographically-protected electronic mail.
> 
> --- END ---
> 
> 
> cheers
> Bernie
> 
> 
> 
> --
> 
> http://ucom.ch/
> Modern Telephony Solutions and Tech Consulting for Internet Technology
> 
> 
> On Thu, 3 Jan 2019, Russ Housley wrote:
> 
>> At the LAMPS session in Bangkok, there was interest in adding a header
>> protection work item to the charter.  Alexey talked about this in Montreal,
>> and he posted a draft a few weeks ago:
>> 
>> 	draft-melnikov-lamps-header-protection.
>> 
>> Several people said that they would implement a solution if the LAMPS WG
>> produced an RFC on this topic.
>> 
>> Shortly before the holidays, DKG proposed charter text:
>> 
>>> 7. Specify a mechanism for the cryptographic protection of e-mail
>>> headers.  Most current implementations protect only the body of the
>>> message, which leaves significant room for attacks against
>>> otherwise-protected messages.  Cryptographic protection (both for
>>> signatures and encryption) which applies to the headers in conjunction
>>> with the message body are necessary to close significant security and
>>> usability gaps in cryptographically-protected electronic mail.
>> 
>> Does anyone have any concerns with this text?  If not, we will ask the
>> Security ADs to add this to the existing charter.
>> 
>> Russ
>> 
>> _______________________________________________
>> Spasm mailing list
>> Spasm@ietf.org
>> https://www.ietf.org/mailman/listinfo/spasm
>> 
> 
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm