Re: [lamps] S/MIME fix

[Tim Hollebeek <[e-mail]>]

This is interesting, I hadn't thought of the parallels with WebRTC, despite 
the fact that I've given a talk on the fact that all of these things are 
basically the same problem.

I have a soft spot for the WebRTC security stuff.  It really is far more 
elegant and well designed than it initially appears.  It's not perfect, but 
it's worth looking at closely and thinking carefully about.

-Tim

> -----Original Message-----
> From: Adam Roach [mailto:[e-mail]]
> Sent: Wednesday, May 16, 2018 6:33 PM
> To: Stephen Farrell <[e-mail]>; Phillip Hallam-Baker
> <[e-mail]>; Tim Hollebeek <[e-mail]>
> Cc: SPASM <[e-mail]>
> Subject: Re: [lamps] S/MIME fix
>
> On 5/16/18 4:16 PM, Stephen Farrell wrote:
> > - Designs pre-date web user agent which changes trust model (where's
> > the private key kept? Needs new infrastructure)
>
>
> To understand the challenges surrounding what you suggest, you probably
> want to study the issues surrounding isolated media streams in WebRTC.
> Start by looking at section 4.3.2.4 of draft-ietf-rtcweb-security, and then 
> read
> through <https://clicktime.symantec.com/a/1/ZUvdrU2DWW-aLe1I1x-
> uWvB_9Olp-hukiQj_tS5vyo4=?d=J11B9dbh9pdZkagcAZSOz6N-
> lMrt249fI1GArrhjTyT2Mv0bxRlEJ34cZbS87eUKrlHkdxKTyM16fzk6Oa2cbNkCsS6
> T7wEgMqMBZ7jiNVeZi__gmD30Y7U3ikHJyMppa7BM6IWhNCSXAbGI1SCtQpF9
> pZ2hlFhqpJrzzXd65YdPDL9iwlDdNbt72F5wUNK26Zb-
> sF9hbGrLwyarefR9gaWnh15R3EjJ-
> OqlLE4CDFWsBJGSxmMLBvwj263QrMrRM72PJxKZU3XFmsj9e3cEupBLjH6N0QX
> oLmMD42i2wt0MnYSoCtKaiTWzTg33hRlj8XVNAc32mj0D-
> o18pnLVxHi2q9Nbdn3kYxepwnSq&u=https%3A%2F%2Fwww.w3.org%2FTR%2F
> webrtc%2F%23isolated-media-streams>.
>
> To create an analogous situation for secure email, you'd need to use 
> webcrypto
> in a way that stored your private key in the browser (inaccessible to the 
> page),
> and develop web standards that add some affordance for web pages to hand
> encrypted data to the browser in a way that causes the corresponding
> unencrypted data to be displayed to the user, but isolated from the web page
> completely (e.g., rendered into an iframe that the parent cannot inspect).
>
> Whether that kind of isolated context for email (which should be usable for
> real-time messaging as well, if done correctly) is reasonable or too clunky 
> to
> work is yet to be seen. (I've had a few conversations that concluded "too
> clunky," but reasonable people may disagree.) In any case, the bulk of the 
> work
> for that kind of system would need to take place in the W3C.
>
> There are, of course, possible trade-offs to be made in which the user 
> trusts
> the web-hosted mail service with access to message plain text, or even to 
> their
> private key; but once you take that leap, you're doing scantly better than 
> the
> hop-by-hop security provided by DANE and/or MTA-STS.
>
> /a