[messaging] The Simple Thing

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 25/09/14 09:48, Trevor Perrin wrote:
> Bouncing messages whenever Bob changes his key seems bad.  Alice
> might send a message and then disconnect, so you can't count on her
> mail client to auto-resend, and the message might be lost or
> delayed.
> 
> So Alice should probably confirm the key with the recipient's
> provider before sending a message.  In which case Bob's email
> header doesn't need to list Bob's key, it just says "X-Lookup-Key:
> True", and Alice remembers that.
> 
> Bob's server would get two connections per message (one from
> Alice, one from Alice's MTA).  It would be nice if Alice could
> contact Bob's MTA once to confirm the key and send the message.  I
> suppose that's feasible in a centralized system where the server
> handles spam by tracking reputations for Alice and Bob.  But it
> doesn't seem feasible for email.

Using a separate connection to look up the key provides a nice
opportunity to route the lookup through an anonymity system. Bob can
anonymously look up his own key from time to time, and if his provider
supplies the wrong key he can switch to another provider and bitch to
his friends, some of whom may believe him. No public consensus on the
truth of Bob's claims is required.

On receiving the message from Alice, Bob's provider will realise who
made the anonymous lookup, but by then it will be too late to supply
the wrong key.

The anonymity system could be Tor, or a special-purpose system in
which each encrypted mail provider operates a relay.

Cheers,
Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBCAAGBQJUJXThAAoJEBEET9GfxSfMcoUH/0s8ir4kiXlmFQKrXVs1koTc
QWvpcoSeiBbzORYSb1zHK44S7O+h0bBi94Kvc2+xsO5deNB/YHBqOlQZNIb8o1bY
1wt226PZ2wyrIZB701qxnQ4iAXhrEb8jQ9QMnUVakRjqC1GU4o1FLyAYxfzKLp1N
UdibZRjtKsIPsh7bl4m8xiZmrc8Lf6IUeIuOwqYDPdx8jOBplYNGP8BU7Jd9F+gV
nv5yo205/4aOeiEyM4EgeOjyH+yawkxmqM8BOAo0+nCfkk1LNyopZAyrZh8nCcYi
C8lx1aJRSNDMcW3AgFXYEGtY4dc5UOs1MtK2DZUT3Ar7frcu+HiFuaOTE1fX1jE=
=lXLy
-----END PGP SIGNATURE-----