Subject: Re: [Spasm] DRAFT charter text

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 May 2016 19:29:13 +0100

On 21/04/16 15:12, John Levine wrote:
>> Now, we are discussing the draft charter
> 
> If there's room, I'd like to work on S/MIME and PGP key distribution
> as in draft-bhjl-x509-srv-00.  I realize the desire to keep the list
> of drafts short, but this one is pretty simple, little more than a
> profile of RFC 4387.

Does anyone else support pursuing work on this draft in the
proposed spasm wg?

Cheers,
S.

> 
> R's,
> John
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>

---

From: Wei Chuang <[email-masked]>
Date: Wed, 11 May 2016 11:34:28 -0700

I think bhjl-x509-srv-00 is useful, and believe spasm is the right place to
work on it.

-Wei

On Wed, May 11, 2016 at 11:29 AM, Stephen Farrell <[email-masked]
> wrote:

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 May 2016 21:06:44 +0100

> I think bhjl-x509-srv-00 is useful, and believe spasm is the right place to

Thanks. So as a follow on - can anyone say that they'd
implement and deploy a non-toy example of this proposed
service? (I mean the ultimate RFC if the WG processed it,
which could look quite different from the -00.)

Cheers,
S.

---

From: "John Levine" <[email-masked]>
Date: 11 May 2016 20:14:24 -0000

>which could look quite different from the -00.)

How big does non-toy have to be?

R's,
John

PS: I'm not snarking, I'm trying to figure out who I'd have to recruit.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 May 2016 21:28:49 +0100

> How big does non-toy have to be?

Good and fair question without a very good answer I guess.

Would it be fair to say that a non-toy service would be
one that could scale to a reasonable subset of the set of
folks who use smime or pgp? I'm very open to a better
characterisation of that.

(To be clear - I'm mostly interested in trying to ensure
we don't spend folks' time defining stuff that'll not get
used.)

Cheers,
S.

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 11 May 2016 13:44:29 -0700

I worry that this is an end-run around the work being done in the DANE group.

Personally, I like this approach much better than the one being pursued by the DANE group.  There are details that I do  not like, but that is what WG eyes are for.

I would be more than willing to do this as an experimental document.  I would not be willing to do this as a standards track document.

Jim

-----Original Message-----
From: Spasm [mailto:[email-masked]] On Behalf Of Stephen Farrell
Sent: Wednesday, May 11, 2016 11:29 AM
To: [email-masked]
Subject: Re: [Spasm] DRAFT charter text

> of drafts short, but this one is pretty simple, little more than a 

Does anyone else support pursuing work on this draft in the proposed spasm wg?

Cheers,
S.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 May 2016 21:55:22 +0100

> I worry that this is an end-run around the work being done in the

end-run seems overstated to me.

> 
> Personally, I like this approach much better than the one being
> pursued by the DANE group.  There are details that I do  not like,
> but that is what WG eyes are for.
> 
> I would be more than willing to do this as an experimental document.
> I would not be willing to do this as a standards track document.

I tend to agree that'd be a very reasonable approach and matches
what we did in DANE.

S

> 
> Jim
> 
> 
> -----Original Message----- From: Spasm
> [mailto:[email-masked]] On Behalf Of Stephen Farrell Sent:
> Wednesday, May 11, 2016 11:29 AM To: [email-masked] Subject: Re:
> [Spasm] DRAFT charter text
> 
> 
> 
>> If there's room, I'd like to work on S/MIME and PGP key
>> distribution as in draft-bhjl-x509-srv-00.  I realize the desire to
>> keep the list of drafts short, but this one is pretty simple,
>> little more than a profile of RFC 4387.
> 
> Cheers, S.
>> R's, John
>> _______________________________________________ Spasm mailing list 
>> [email-masked] https://www.ietf.org/mailman/listinfo/spasm
>> 
> 
> 
> _______________________________________________ Spasm mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/spasm
>

---

From: "John Levine" <[email-masked]>
Date: 11 May 2016 21:20:24 -0000

>I worry that this is an end-run around the work being done in the DANE group.

I'd say it's more an exasperated response than an end-run.  The
openpgpkey draft is experimental, and I think it is fair to say that
it has very little support from the SMTP mail community.

>I would be more than willing to do this as an experimental document.  I would not be willing to do this as a standards

About 95% of it is from RFC 4387 which has been on the standards track
for a decade.  I tried to make it clear that this is just a key
distribution scheme, not a way to assert that these are "real" keys
unless a domain uses DANE to explicitly publish its S/MIME signing key.

I don't understand what the experiment would be.

R's,
JOhn

---

From: Michael Richardson <[email-masked]>
Date: Wed, 11 May 2016 17:41:13 -0400

> PS: I'm not snarking, I'm trying to figure out who I'd have to recruit.

On the side of doing this in MUAs, one of:
   gmail, thunderbird, outlook

On the side of doing this in MTAs (encrypting to destination, not signing,
I'm unclear if that is in scope), one of:
   sendmail.org,
   postfix.org,
   MS-Exchange
   Zimbra
   Might interest: https://www.roaringpenguin.com/products/canit-secure-messaging

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Yoav Nir <[email-masked]>
Date: Thu, 12 May 2016 01:03:56 +0300

Hi, Michael

> On 12 May 2016, at 12:41 AM, Michael Richardson <[email-masked]> wrote:
> 
> 
> 

Not saying I’m against this, but this looks like rather a high bar.

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 11 May 2016 15:33:34 -0700

I think that the experiment is can you get some major mail clients to
implement and can you get some major companies to provide the service.  

I know of clients that implement ldap lookup and it is used internally in
companies, but companies do not expose their ldap servers to the world for a
number of valid reasons.  This is a more restricted query than ldap but it
is still a question of are people going to allow for exposure of the
interface or not.

I would not want to see it advance from experimental to standards track
without some show of adoption.

Jim

-----Original Message-----
From: Spasm [mailto:[email-masked]] On Behalf Of John Levine
Sent: Wednesday, May 11, 2016 2:20 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [Spasm] DRAFT charter text

>I worry that this is an end-run around the work being done in the DANE
group.

I'd say it's more an exasperated response than an end-run.  The openpgpkey
draft is experimental, and I think it is fair to say that it has very little
support from the SMTP mail community.

>I would be more than willing to do this as an experimental document.  I 
>would not be willing to do this as a standards track document.

About 95% of it is from RFC 4387 which has been on the standards track for a
decade.  I tried to make it clear that this is just a key distribution
scheme, not a way to assert that these are "real" keys unless a domain uses
DANE to explicitly publish its S/MIME signing key.

R's,
JOhn

---

From: Michael Richardson <[email-masked]>
Date: Wed, 11 May 2016 19:28:49 -0400

> Not saying I’m against this, but this looks like rather a high bar.

And thus the reason encrypted email continues to fail to take off...

---

From: "John R Levine" <[email-masked]>
Date: 11 May 2016 22:48:21 -0400

> implement and can you get some major companies to provide the service.

As far as I can tell, that's never been a bar for proposed standard 
before, but I agree it'd be interesting to find out.

I'll be talking to people from a lot of large mail operators at MAAWG next 
month, will see if anyone is interested.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: Michael Richardson <[email-masked]>
Date: Thu, 12 May 2016 18:37:54 -0400

> As far as I can tell, that's never been a bar for proposed standard before,
    > but I agree it'd be interesting to find out.

True.  The point is more of the: why produce another specification that
nobody will implement?

    > Please consider the environment before reading this e-mail.

Please consider the environment before implementing a new spec.
:-) :-)

---

From: Russ Housley <[email-masked]>
Date: Thu, 12 May 2016 18:52:25 -0400

> As far as I can tell, that's never been a bar for proposed standard before, but I agree it'd be interesting to find out.
> 
> I'll be talking to people from a lot of large mail operators at MAAWG next month, will see if anyone is interested.

Stephen is trying to charter updates to the PKIX and S/MIME specifications that will be implemented in this working group.  Stephen did not say that other paths to proposed standard would be blocked for ideas that could not clear that bar.

Russ