Subject: [openpgp] Work items for openpgp relaunch: Content-type equivalent

From: Tim Bray <[email-masked]>
Date: Sun, 15 Mar 2015 09:49:21 +1300

I did quite a bit of work on a PGP app last summer, OpenKeychain, which
leverages the Android “sharing” system very effectively to produce a pretty
nice UX for encryption/signing/key-discovery/decryption/verification.  See
https://play.google.com/store/apps/details?id=org.sufficientlysecure.keychain&hl=en

There’s one missing piece, the equivalent of HTTP Content-type.  You can
easily encrypt anything - a message, a picture, a video - and send it off
to anyone, and have them decrypt it straightforwardly with no user-visible
crypto incantations.  But then how does the receiver process it
automatically unless it knows the payload data format?

I’m aware that S/MIME does this, but that was not terribly relevant in the
Android-app context.

I’m aware there have been proposals for a new packet type for this purpose
but I don't want to presuppose any conclusions; just noting that I've
encountered a real actual need here in real actual software.  I’d be able
to invest some cycles on this if there’s interest among others.

-- 
- Tim Bray (If you’d like to send me a private message, see
https://keybase.io/timbray)

---

From: Werner Koch <[email-masked]>
Date: Sun, 15 Mar 2015 20:43:36 +0100

> easily encrypt anything - a message, a picture, a video - and send it off

What about using RFC-3156 PGP/MIME and set the Content-type? 

IIRC, a new flag 'm' for the Literal Data Packet was once suggest to
indicate the data has a MIME structure.  That would allow to convey all
kind of meta information using a matured standard.

Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: Dominik Schuermann <[email-masked]>
Date: Sun, 15 Mar 2015 21:12:46 +0100

Hi Werner,

> What about using RFC-3156 PGP/MIME and set the Content-type? 

If setting the Content-type to something different than
"application/octet-stream" would leak the Content-type to others or do
you have a different usage in mind?

There are related problems to this:
- RFC 3156 only considers the usage of ASCII armored data, we also like
to share encrypted binary files.
- Currently we "share" a blob with Content-type
"application/octet-stream", while we actually want something more
concrete that identifies OpenPGP-encrypted blobs. We don't use
"application/pgp-encrypted" as it is specified to only hold the version
number.

> kind of meta information using a matured standard.

The related draft is here:
http://tools.ietf.org/html/draft-moscaritolo-openpgp-literal-01

I like this approach as it hides the MIME type in the encrypted header.
Having this and a MIME type for OpenPGP-encrypted blobs would solve the
problem for us, what about "application/pgp-encryption"?

Maybe I am overseeing something, so any pointers are appreciated :)

Regards
Dominik

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sun, 15 Mar 2015 17:50:34 -0400

> What about using RFC-3156 PGP/MIME and set the Content-type? 

I agree that reusing PGP/MIME to get this functionality is better than
re-inventing it elsewhere.

> kind of meta information using a matured standard.

I like this proposal, and i think it would make a useful extension to
https://tools.ietf.org/html/rfc4880#section-5.9

        --dkg