<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Oct 17, 2013 at 3:26 PM, David Mercer <span dir="ltr"><<a href="mailto:radix42@gmail.com" target="_blank">radix42@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>On Wed, Oct 16, 2013 at 1:43 AM, Phillip Hallam-Baker <span dir="ltr"><<a href="mailto:hallam@gmail.com" target="_blank">hallam@gmail.com</a>></span> wrote:<br>
</div><div class="gmail_extra"><div class="gmail_quote"><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>I was noodling round with the problem of how to force an existing client to do the right thing with respect to encryption. One option is to have an email gateway do opportunistic encryption if it can find a key. Which is OK but lacks user control. </div>
</div></blockquote><div> </div></div><div>*snip*</div><div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div></div>
An email sender may send email to Alice through a compliant gateway as
follows:</div></blockquote><div><br></div></div><div>*snip* </div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><dl>
<dt>ACACEA-H7MBAA-LAA2RMA-FUAAFQ-AADHAHS-KNAL3A-DPZJAJ-KAA?<a href="mailto:alice@example.com" target="_blank">alice@example.com</a></dt>
<dd>Send email to Alice using encryption if and only if an encryption key
for Alice can be found that is directly endorsed under the specified key,
otherwise report an error.</dd>
<dt>ACACEA-H7MBAA-LAA2RMA-FUAAFQ-AADHAHS-KNAL3A-DPZJAJ-KAA??<a href="mailto:alice@example.com" target="_blank">alice@example.com</a></dt>
<dd>Send email to Alice using encryption if and only if an encryption key
for Alice can be found that is (directly or indierectly) endorsed under
the specified key, otherwise report an error.</dd></dl></div></blockquote><div> </div></div></div><div>This reminds me a lot of RFC 5233 email address local-part tagging, e.g. having a client convert one of the above to </div>
<div><a href="mailto:alice%2BACACEA-H7MBAA-LAA2RMA-FUAAFQ-AADHAHS-KNAL3A-DPZJAJ-KAA@exmple.com" target="_blank">alice+ACACEA-H7MBAA-LAA2RMA-FUAAFQ-AADHAHS-KNAL3A-DPZJAJ-KAA@exmple.com</a> when it has the key.</div></div>
</div></blockquote><div><br></div><div>We could reverse the order if people prefer, that would make it easier for autocomplete to function since someone is going to start typing 'alice' It is arguably tidier too since all the user related stuff is at one end and all the plumbing at the other.</div>
<div><br></div><div>I'll wait for more comments before making any changes though.</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">
<div class="gmail_extra"><div>The pity is that different systems use a different character: plus (gmail, apple, lots of others), a hyphen (yahoo, qmail and courier, notably), an equals sign (mmdf) or freaking anything (postfix, didn't look up if there is an easily un-commentable default).</div>
</div></div></blockquote><div><br></div><div>That is one of the reasons I chose ?, it is not already in use for other schemes that might conflict.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div class="gmail_extra"><div>Having the key identifier to the left of the untagged local-part is a nice twist; the client could then look up an attribute in it's address book to see if there was a local-part tag delimiter. This could easy auto-mated client and/or gateway processing of the encryption at either or both ends. </div>
</div></div></blockquote><div> </div></div>Just to make clear, this is the option for forcing use of encryption that is designed for backwards compatibility sending email from existing clients with the encryption taking place on a local submit gateway on the same machine.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">If someone was to write a new client or plug in that was aware of this stuff, they would hopefully take the opportunity to do a better job.<br clear="all"><div>
<br>
</div>-- <br>Website: <a href="http://hallambaker.com/" target="_blank">http://hallambaker.com/</a><br>
</div></div>