and (debatably) doesn't have to survive all of the mangling that
might happen to messages as they pass through mailing lists and
the like.
This I STRONGLY STRONGLY disagree. The system MUST be able to work
within current email infrastructure and not break it. That means
the signature must survive emails and forwarders and all other
common email retransmision systems.
This is exactly the kind of war by proxy that I was referring to.
I agree that it is desirable that a signature be resistant to mangling
as a message is forwarded and reformatted. On the other hand, I also
think it is desirable that a signature cover the headers that are
likely to be displayed to the user. Unless we think we're vastly
smarter than the people who designed S/MIME, their experience tells us
that we can't have both. They worked hard and came up with a scheme
that signs message bodies in a robust way but in view of the amazing
variety of ways that MTAs and MUAs mangle headers (Exchange and
Outlook are the poster children here), they left headers entirely out
of the story.
A requirement that signatures be mangle-proof is in practice saying
that the scheme be S/MIME, give or take signature granularity and key
distribution. I'm not ruling that out, but I'm sure not willing to
rule it in at this point either.
That's why I think we should accept a generally worded charter such as
the one that Dave C has written, and go ahead and look at the merits
of the actual proposals rather than having airy discussions about what
a hypothetical signing scheme should do. I concur that it's possible
that none of the proposals will prove adequate, but I think we can
burn that bridge if and when we come to it.
I'd like an automobile that costs nothing, protects the occupants from
injury in any possible type of accident, gets a thousand miles to the
gallon, and has no effect on the environment, but making those my
requirements isn't going to help me buy a car.
Regards,
John Levine, johnl(_at_)taugh(_dot_)com, Taughannock Networks, Trumansburg NY
http://www.taugh.com
--
John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711
johnl(_at_)iecc(_dot_)com, Mayor, http://johnlevine.com,
Member, Provisional board, Coalition Against Unsolicited Commercial E-mail