I may be too simple-minded (I often am), but what's wrong with a truly
trivial MIME multipart/encrypted that just has:
...
I always thought the separation of the security multiparts from the
MOSS stuff was intended to make this truly trivial?
I agree. RFC security multiparts are great for this kind of thing. Why bother
will all that PGP overhead of RSA/DH etc, when parties can do what do you
just said
so simply - in the same family-and-friends privacy model. And there are NO
public-key
license fees in the US, either, for COMMERCIAL use, note, Amanda.
Great stuff. No symmetric *key distribution* service is provided though,
which was the original point. Its indeed pretty good privacy though. The key
distribution problem is what was unfortunately lost in the rush to MOSS,
from PEM 1421 &
PEM Part V. But it should be possible to retrofit this into security
multiparts now
the technical community has settled on multiparts as logically viable. (time
will
tell in the infrastructure, but lets be positive, and work at it.)
Lets get users who value IDEA as a cipher to get together and define a
multipart/encrypted protocol based on your idea, Harold. RSA DSI's PKCS5
suggests a well-accepted way of converting an application pass phrase
securely into a
key value.
You are right. Its very simple. Its also very effective for small bilateral
business
communities who require decent content confidentiality over persistant
inter-application
channels, at little technical or software cost. Clearly, the real costs will
be in the
out-of-band key distribution. But for small groups or bilateral
relationships, this is not expensive.