[openpgp] Re: Fwd: New Version Notification for draft-gall agher-email-invisible-signatures-00.txt

Michael Richardson <[email protected]> Tue, 06 May 2025 14:54:11 +0100

Newsgroups	gmane.ietf.openpgp
Message-ID	<1209166.1746539651@dyas>

Daniel Kahn Gillmor <[email protected]> wrote:
    > On Sat 2025-05-03 15:46:00 -0400, Michael Richardson wrote:
    >> Andrew Gallagher <[email protected]> wrote:
    >>
    >>> Instead of including the signature as an attachment, we propose that
    >>> the signature is contained within a novel MIME header in the
    >>> top-level MIME part. The principal advantage of this is that naive
    >>> MUAs should silently ignore unknown MIME-part headers, which
    >>> addresses the “unknown attachment” UX problem when using traditional
    >>> PGP/MIME.
    >>
    >> okay, I like the idea of fixing the UX problem.  I'm not sure how
    >> popular the solution will be, I'm totally willing to try.
    >>
    >> Let's adopt this if we can.

    > It looks to me like you're asking for working group adoption, Michael.

I didn't exactly mean that when I wrote the above, so much as I meant, I want do it :-)

I don't think we'll get much traction without an RFC, so implicit was, yeah,
that OPENPGP should adopt it as working group document.

    > There's not much in this draft that touches on the OpenPGP framing at
    > all; pretty much the only use it makes of the wire format is to expect
    > implementations to be able to:

Yes. But I think it's in our charter to progress the work.

    > Given this, i'm inclined to say that this belongs more in a
    > mail-oriented WG, not in the OpenPGP WG.  Perhaps that's MAILMAINT or
    > LAMPS.

Ask MAILMAINT to review, do a co-WG WGLC, but I think remain in this WG.
It's really not a LAMPS thing, I think.
If this works, maybe SMIME (CMS) will want to do the same.

    > At any rate, if we can't decide on a reasonable venue up front, i'd be
    > happy to shop this around at SECDISPATCH in this summer's IETF,
    > particularly if we have a couple implementations that can demonstrate
    > interoperable signing and verification.

Yes, running code good.

--
Michael Richardson <[email protected]>, Sandelman Software Works
 -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 658 B)