Subject: [apps-discuss] APP Area Consideration of draft-cailleux-secure-headers

From: Chris Bonatti <[email-masked]>
Date: Wed, 20 Jun 2012 14:17:41 -0400

Hello Apps Area:

Laurent Cailleux and have started a draft that we intend to document 
some experimental work on the protection of email headers.  I would like 
to recommend it to APPS folks for review and comment.  We had some 
limited feedback on the -00 version, which resulted in an improved -01 
issued in April.  This has been laying fallow for a few months, and we 
have had very little input.  The draft (now 
http://www.ietf.org/id/draft-cailleux-secure-headers-01.txt) describes 
how the S/MIME protocol can be extended in order to secure message 
header fields. It defines a 'Secure Headers' extension that provides 
security services such as data integrity, non-repudiation and 
confidentiality.

Ordinarily S/MIME secures message body parts, but does not protect the 
message header fields.
However, it does define an alternative solution to secure header fields. 
To wit: "The sending client MAY wrap a full MIME [RFC 2045] message in a 
message/rfc822 wrapper in order to apply S/MIME security services to 
header fields". This encapsulation solution does not allow selection of 
a subset of message header fields to secure, and confidentiality service 
cannot be implemented for message header fields. Other security 
mechanisms introduced to date (DKIM, TLS, etc.) similarly address only 
parts of the problem.  The solution we propose overcomes those limitations.

This draft primarily documents a security mechanism, so I view it as a 
product of the SEC Area.  However, it clearly has a lot to do with 
email.  So I'd like to recommend that the APPS area people take an 
earnest look.  Our proposal is that this be advanced as an Experimental RFC.

I look forward to your feedback.

Regards,
Chris B.