Subject: Re: confidential subject lines -> use content description field w/ pgp/mime?

From: [email-masked]
Date: Thu, 15 Jun 2000 13:52:59 -0700

> > So far in this thread, two methods of encrypting headers have been 
> > discussed: encapsulating a complete message in a message/rfc822 and 
> > encapsulating an SMTP session in BSMTP. Both can be used for end-to-end 
> > encryption and the first probably inter-operates quite well amongst 
> > existing PGP/MIME or S/MIME clients.
>
> at this point, i'd like to see the methods mentioned/referred to in
> some specification so i can point mail client developers at such a
> document for the purposes of having them work on implementations that
> will interoperate.

I don't see what any of this has to do with OpenPGP.  Modifying SMTP
is clearly out of our scope, and message/rfc822 is already defined in
the MIME spec.  We don't have anything to do with this, and IMO this
discussion should be transferred elsewhere.

Hal Finney

---

From: [email-masked]
Date: Fri, 16 Jun 2000 06:04:16 +0900

From: [email-masked]
Subject: Re: confidential subject lines -> use content description field w/ pgp/mime?
Date: Thu, 15 Jun 2000 13:52:59 -0700
Message-ID: <[email-masked]>

> discussion should be transferred elsewhere.

i think an important point is that if you look at the openpgp/mime
spec or the openpgp spec as they stand now, they don't explicitly
mention either of the methods for protecting header information of
messages.  at least i didn't notice any mention of them...perhaps i
miseed something?

last i checked, the headers are part of the message -- if one of the
goals of openpgp/mime is to protect message confidentiality, then i
think it's relevant to at least mention the aforementioned methods in
one of the openpgp specs.

how many mail clients claim pgp/mime compatibility?

  http://www.cryptorights.org/pgp-users/pgp-mail-clients.html

how many of those protect message headers?  there may be a few, but
i have yet to encouter one.

i think this is a problem that could be addressed by placing a
disucssion of the issue in an existing spec or to create a new spec
for that purpose.  it is far more likely for header protection to be
implemented that way.

we may disagree about how important header protection is, but it seems
pretty related to openpgp (at least openpgp/mime) to me.