Zitat von Martijn Brinkers <[email protected]>:
[email protected] wrote:The root-evil of PKI is raising its ugly head.... Once designed as all including directory, and later extended for off-line usage with kludges like revocation-lists and expiring certificates. :-(There is however not really an alternative. PGP keys for example never expire (which is kind of possible with X.509 certificates by making them valid for 100 years). Even though it is possible to sign PGP keys, most PGP keys are not signed. Whether a PGP is trusted should be decided for each individual key. PGP doesn't support a general certificate revocation mechanism (CRLs). You can decide to skip all PKI features, like using never expiring certificates, do not use CRL etc. Then PGP and S/MIME are kind of similar. Then you have some other proprietary solutions like Voltage IBE but these are only usable for a closed setup. Not that this helps you in any way but if there was a good alternative I would probably have used it.
No offense intended...The solution with S/MIME at gateway level is the most usable way i have found until now, that's why we are using Djigzo after all ;-) But the usability for end-users will be the key point for propagation of encryption and yes i'm totaly aware that no idiot-proof *and* secure system is possible, but we should try hard to get close.
If I would have enough time I would create add-ins for most email clients to be more pragmatic when it comes to PKI rules (in the past I actually created several S/MIME email client add-ons but that was with a different company). Explain more and allow users to override the default PKI behavior. Most S/MIME clients are not built by technicians that didn't think about the end-user.
The problem is that the crypto part is not one of the top priorities by the mailclient designers. If have read a discussion lately where one of the maintainer of Thunderbird explained that the crypto part is mostly stuck after 1999 development :-(
The crypto part of Outlook is confusing at least...
Instead of having the email client doing all PKI checks perhaps the gateway should do it for the end-user. This way the gateway can do more detailed checks and the PKI strictness can be set by the administrator.
With this the problem is how to get the "trust" from the gateway to the client. After all the most important part is to inform the user in clear way what the status of a message is.
It's a pitty that only a few people try hard to get signing/encryption usable. Djigzo is a Tool in the right direction but i think we need more to get S/MIME usable by non-Geeks in large scale.True. Like for example a public certificate directory. We also need more pragmatic email clients that allows certain overrides.BTW: It seems that Bouncy Castle which is included in Djigzo support RFC 3161 extension. May i ask if you could check how difficult it may be to include something like timestamping in Djigzo?I'll need some time to look at the documents. If it would be added how are you going to check the signature?
It is more of a future plan. If it is there, it may be easier to convince the mailclient designer to check it. It was simply a idea to get a chicken out of the door so sometime in the future the egg will follow ;-) If it don't confuse S/MIME clients not supporting it, no harm is done but we are ready if someday the timestamp check is integrated at the clients.
Many Thanks Andreas
smime.p7s
Description: S/MIME Signatur
_______________________________________________ Users mailing list [email protected] http://lists.djigzo.com/lists/listinfo/users
