Re: Secure email (was: Re: [friam] and so it goes )

--===============6690434434817156923==
Content-Type: multipart/alternative; boundary=001a11400e20b6a0b60529a40c4f

--001a11400e20b6a0b60529a40c4f
Content-Type: text/plain; charset=UTF-8

One way to handle key rollover is to start with two keys with different
expiration dates, k1 and k2.  Before k1 expires, you generate k3 and
certify it using k2.  Use k2 as your primary and k3 as secondary.  Lather
rinse repeat.  This approach does not cover the case of a k2 being
compromised, but its private key can be kept offline until


--------------
Alan Karp

On Mon, Jan 18, 2016 at 1:56 PM, Jed Donnelley <capability-iCFHVraI1K1Wk0Htik3J/[email protected]>
wrote:

> On 1/18/2016 8:57 AM, Sandro Magi wrote:
>
>> Certainly a marked improvement over unencrypted content, but it doesn't
>> handle
>> key expiry. Once my key expires, all my subsequent e-mails to you will
>> not match
>> the public key you stored, so what's a key update protocol that's also
>> secure?
>>
>
> Thanks for the comments.   When your key expires (e.g. you reinstall your
> software or even a timeout), if you send "me" an email my client will
> recognize the new public key from a recognized "from" address, notify me
> (if I care), and save the new key.
> If I care about the notification I can do whatever I wish to reestablish
> trust with the sender with the new key.  In the rare but important (e.g.
> legal or financial) case where a key is bound to a person or institution
> then a new key binding must be done (see below for details).
>
> If your key expires and 'I' send you a message before you send me one then
> your client will respond with a "key change" message (rather than
> displaying the distracting cypher text) - resulting in the situation above.
>
> Since I mentioned "key binding" above I may as well restate a simple
> protocol that I believe can leverage a secure web site login (common for
> financial/legal sites) to establish a key binding for secure email.  I
> login to my web site and submit my email address and its associated public
> key to a form.  The web site binds that public key to the email address.
> Thereafter any email signed by my private key can be assumed to be from me
> - until my key expires, when I need to do a rebinding.  Anybody see any
> problem with that protocol?
>
> For typical email use, however, I don't consider key binding a significant
> issue.  I'd be quite comfortable just accepting a new key binding from
> anybody sending email to me in nearly all circumstances.  Even if I do so
> without any check or exchange I'm better off than I am now as at least ALL
> messages will be encrypted and signed - even if the sender isn't
> necessarily bound to a specific person or institution.  Having been
> notified of and accepted a new key binding to an email address, I might be
> on somewhat more alert about a potential man in the middle attack, but how
> often do I care?  I certainly don't have any support for caring now.  If I
> did care in future I could do key binding more generally (e.g. testing via
> alternative communication such as telephone, video chat, or whatever).  As
> I say, I really don't see key binding as a practical problem except for
> very rare cases where something like the key binding through a secure web
> login (as above) seems perfectly adequate to me.
>
> Encrypted messages also reduces the effectiveness of search, which is a big
>> issue with today's e-mail volume.
>>
>
> Are you referring to searching my own email archive?  In that case why
> can't it just be the clear text that is saved and searched?
>
> If you are referring to some other email being searched, please clarify
> why one would need to "search" encrypted email.
>
> --Jed
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>

--001a11400e20b6a0b60529a40c4f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">One way to handle key rollover is to start with two keys w=
ith different expiration dates, k1 and k2.=C2=A0 Before k1 expires, you gen=
erate k3 and certify it using k2.=C2=A0 Use k2 as your primary and k3 as se=
condary.=C2=A0 Lather rinse repeat.=C2=A0 This approach does not cover the =
case of a k2 being compromised, but its private key can be kept offline unt=
il</div><div class=3D"gmail_extra"><br clear=3D"all"><div><div class=3D"gma=
il_signature"><br>--------------<br>Alan Karp</div></div>
<br><div class=3D"gmail_quote">On Mon, Jan 18, 2016 at 1:56 PM, Jed Donnell=
ey <span dir=3D"ltr">&lt;<a href=3D"mailto:capability-iCFHVraI1K1Wk0Htik3J/[email protected]" target=
=3D"_blank">capability-iCFHVraI1K1Wk0Htik3J/[email protected]</a>&gt;</span> wrote:<br><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p=
adding-left:1ex">On 1/18/2016 8:57 AM, Sandro Magi wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Certainly a marked improvement over unencrypted content, but it doesn&#39;t=
 handle<br>
key expiry. Once my key expires, all my subsequent e-mails to you will not =
match<br>
the public key you stored, so what&#39;s a key update protocol that&#39;s a=
lso secure?<br>
</blockquote>
<br>
Thanks for the comments.=C2=A0 =C2=A0When your key expires (e.g. you reinst=
all your software or even a timeout), if you send &quot;me&quot; an email m=
y client will recognize the new public key from a recognized &quot;from&quo=
t; address, notify me (if I care), and save the new key.<br>
If I care about the notification I can do whatever I wish to reestablish tr=
ust with the sender with the new key.=C2=A0 In the rare but important (e.g.=
 legal or financial) case where a key is bound to a person or institution t=
hen a new key binding must be done (see below for details).<br>
<br>
If your key expires and &#39;I&#39; send you a message before you send me o=
ne then your client will respond with a &quot;key change&quot; message (rat=
her than displaying the distracting cypher text) - resulting in the situati=
on above.<br>
<br>
Since I mentioned &quot;key binding&quot; above I may as well restate a sim=
ple protocol that I believe can leverage a secure web site login (common fo=
r financial/legal sites) to establish a key binding for secure email.=C2=A0=
 I login to my web site and submit my email address and its associated publ=
ic key to a form.=C2=A0 The web site binds that public key to the email add=
ress.=C2=A0 Thereafter any email signed by my private key can be assumed to=
 be from me - until my key expires, when I need to do a rebinding.=C2=A0 An=
ybody see any problem with that protocol?<br>
<br>
For typical email use, however, I don&#39;t consider key binding a signific=
ant issue.=C2=A0 I&#39;d be quite comfortable just accepting a new key bind=
ing from anybody sending email to me in nearly all circumstances.=C2=A0 Eve=
n if I do so without any check or exchange I&#39;m better off than I am now=
 as at least ALL messages will be encrypted and signed - even if the sender=
 isn&#39;t necessarily bound to a specific person or institution.=C2=A0 Hav=
ing been notified of and accepted a new key binding to an email address, I =
might be on somewhat more alert about a potential man in the middle attack,=
 but how often do I care?=C2=A0 I certainly don&#39;t have any support for =
caring now.=C2=A0 If I did care in future I could do key binding more gener=
ally (e.g. testing via alternative communication such as telephone, video c=
hat, or whatever).=C2=A0 As I say, I really don&#39;t see key binding as a =
practical problem except for very rare cases where something like the key b=
inding through a secure web login (as above) seems perfectly adequate to me=
.<br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Encrypted messages also reduces the effectiveness of search, which is a big=
<br>
issue with today&#39;s e-mail volume.<br>
</blockquote>
<br>
Are you referring to searching my own email archive?=C2=A0 In that case why=
 can&#39;t it just be the clear text that is saved and searched?<br>
<br>
If you are referring to some other email being searched, please clarify why=
 one would need to &quot;search&quot; encrypted email.<br>
<br>
--Jed<br>
_______________________________________________<br>
cap-talk mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">cap-talk@mai=
l.eros-os.org</a><br>
<a href=3D"http://www.eros-os.org/mailman/listinfo/cap-talk" rel=3D"norefer=
rer" target=3D"_blank">http://www.eros-os.org/mailman/listinfo/cap-talk</a>=
<br>
</blockquote></div><br></div>

--001a11400e20b6a0b60529a40c4f--

--===============6690434434817156923==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk

--===============6690434434817156923==--