Re: rough sketch of a potential solution

Keith Moore <[email protected]> Mon, 17 Nov 2003 21:02:55 -0500
Newsgroups gmane.ietf.imaa
Message-ID <[email protected]>
Actually in thinking about this some more I realized that the problem 
with a message signed by someone else other than the author(s) is that 
there's no way for the recipient (or the recipient's MUA) to know 
whether the message has been altered between the version produced by 
the original author(s) and the version that was signed.

So if we want to support a  "witness" or "notary" function that 
probably means an extension to S/MIME  and/or OpenPGP.  And probably 
each of the original authors would have to sign the message, and then 
the witness/notary would sign *that*.

And that also seems to mean that for I18N'ed email addresses, signed 
messages MUST have a single address in the From field (either pure 
ASCII or IMAA encoded), and the signature MUST be from this address.   
Which certainly makes the work of this group simpler.  Though if S/MIME 
and/or OpenPGP were ever to support notarization, this might be subject 
to change, but such changes would require upgrades to MUAs anyway.

Keith