Re: IMAP vs. multipart/signed
Michael Elkins (elkins@aero.org)
Wed, 28 Feb 1996 10:05:09 -0800
On Feb 28, Terry Gray <gray@cac.washington.edu> wrote:
> But it's worse than that: as far as I know, the mailcap dispatch
> infrastructure has no way of dealing with parameters, so we have to
> re-invent/extend the dispatch mechanism as well.
That's not completely true. Metamail understands parameters just fine.
Here is my .mailcap entry for the multipart security suite:
multipart/encrypted; showencrypted %{boundary} %s; \
test=test %{protocol} = application/pgp-encrypted
multipart/signed; showsigned %{boundary} %s; \
test=test %{protocol} = application/pgp-signature
Notice that both the "protocol" and "boundary" paremeters are being passed
the the application
> > The approach we took in the architecture is that if something is encrypted
> > all bets are off. If it's yours you won't have any trouble, but if it's
> > not, the object was intended to be opaque to you and therefore it should
> > be.
>
> This reasoning has, I think, a fatal flaw: the "if it's yours" implies
> that you/I support a single secure email technology, and the incoming
> message either matches or doesn't. I wish that were going to be true, but
> it's now obvious that it won't be.
I just want to throw out a problem in the logic for the argument for
changing the content-type from application/octet-stream to
application/<crypto-system>. . . Several persons have argued that it
should be changed such that a non-security-aware MUA could still handle
it even if it couldn't get at the parameters. Well, since there are
TWO parts to a multipart/encrypted, how would this really help? If you
are only passed the encrypted data you have no information about _HOW_
to decrypt it! You need both parts... I suppose you could have some
hack by which your application buffers the first body when its dispatched,
and then wait for the second part, but yuck! Why not just do it right?
me
--
Michael Elkins <elkins@aero.org> http://www.cs.hmc.edu/~me/index.html
PGP mail preferred. Key availible via web or 'finger -l me@cs.hmc.edu'
Key fingerprint = EB B1 68 32 3F B5 54 F9 6C AF 4E 94 5A EB 90 EC
"I could be wasting my time more productively than this." --me