Re: [smime] Key lookup service via draft-bhjl-x509-srv-00

> My advice is to keep it as simple as possible.  MUAs interact directly with users, so it should be MUAs that provide assurance, not mail providers.  This relieves the provider from having to worry about it, and users can opt in or out at will using any mail provider or key infrastructure they choose (up to and including roll-your-own).

I wouldn't disagree, but I would also point out that there are a lot of 
people who are eager to add a per-domain key lookup to their mail service. 
There are proposals in DANE to publish PGP and S/MIME keys directly in the 
DNS which are a bad idea for various reasons, but I don't see any reason 
that a domain operator shouldn't be able to offer a key server if it 
wants.  Scott Rose at NIST and Richard Lau at ICANN have expressed 
interest in the DANE versions, so I'd like to give them an option that 
could work.

My main concern would be to keep it crystal clear that the key server 
semantics are "foo.com asserts this is the key for [email protected]" rather 
than "this is the key for [email protected]".

Regards,
John Levine, [email protected], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix