OpenPGP data in the CERT RR

[Simon Josefsson]

"John A. Martin" <jam at jamux.com> writes:

>>>>>> "Simon" == Simon Josefsson
>>>>>> "Re: OpenPGP data in the CERT RR"
>>>>>>  Tue, 06 Aug 2002 14:25:42 +0200
>
>     Simon> Header-sender ("From:") shouldn't be rewritten, I think,
>     Simon> and is a suitable guess.  SMTP envelope sender is pretty
>     Simon> useless, yes.
>
> Many outgoing mail relays will munge From: <foobar at foo.baz.bar> into
> <foobar at baz.bar>.  That is just one example used by many who you might
> find reluctant to accept that they shouldn't be doing it.  

Then the key needs to be stored at foobar.baz.bar to be found.

This kind of munging can probably improve the situation, as not
everyone will store the data at foobar.foo.baz.bar (assuming foo is
just one machine out of many, on a campus).

> Besides, there are a lot of misguided mailers out there.  An
> X-something header field would however be likely to be munged only
> in an effort to interfere specifically with the PGP operation.
>
> For completeness one might well be lead to consider other originator
> header fields, such as "Reply-To" fields.  It would seem that the
> complexities of dealing with munged, falsified, or alternate forms may
> not be worthwhile compared to the simplicity of an X-something header
> field.

If the From: line isn't good enough to find the certificate, it won't
work.  If the sender wants to make sure the receiver can find the
certificate, she can include it or include an URL to its exact
location.  Or use the correct From: line.

> Besides the problems faced by users who do not necessarily have full
> control of the header-sender fields that may be present in their
> mails, consider those who may use a multitude of sender addresses.
> Besides encouraging a proliferation of PGP user IDs it seems contrary
> to the _privacy_ part of PGP to encourage folks to carry a user ID for
> each and every domain from which they may want to send PGP mail.  How
> should a contract worker, for example, explain to his clients that
> they will have less convenient access to his keys because he chooses
> not to list all his clients' domains on his PGP key.

You don't need to use it.  I only noticed it would work for me, since
I control my own domain.  I don't think I'm alone in this regard, so
others benefit from it too.  It doesn't solve all problems, but it is
convenient in some situations.

> It might avoid a lot of problems to designate an optional mail header
> field in the sense of Section 3.6.8 of rfc2822 rather than to overload
> existing mail header fields to carry information for purposes other
> than the purposes those fields already serve.

Actually, wouldn't it make more sense to include a "preferred
keyserver" option in the OpenPGP message instead?  That would solve
the same problem, and even work in non-email situations.