Smime signature verification in Notmuch - Emacs

Smime signature verification in Notmuch - Emacs

[Baptiste]

[-- Attachment #1: Type: text/plain, Size: 408 bytes --]

Hi, 

I made a little ~Emacs~ advice for ~notmuch-show-insert-part-multipart/signed~ to deal with mails signed with /SMIME/ mechanism. It calls /openssl/ to create missing :sigstatus.

Here it is : [[https://github.com/bateast/notmuch-openssl]]
(it is an org-file, in ~Emacs~, use /org-babel-tangle/ on it to extract the .el).

You are welcomed to make any comment.

Thanks,

-- 

: ~^v^~ Bat

[-- Attachment #2.1.1: Type: text/html, Size: 657 bytes --]

[-- Attachment #2.1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2335 bytes --]

Re: Smime signature verification in Notmuch - Emacs

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 1392 bytes --]

Hi Baptiste--

On 03/03/2014 12:29 PM, Baptiste wrote:
> I made a little |Emacs| advice for |notmuch-show-insert-part-multipart/signed| 
> to deal with mails signed with /SMIME/ mechanism. It calls /openssl/ to create 
> missing :sigstatus.
> 
> Here it is : https://github.com/bateast/notmuch-openssl
> (it is an org-file, in |Emacs|, use /org-babel-tangle/ on it to extract the .el).
> 
> You are welcomed to make any comment.

i'm interested in the functionality you're describing, but i confess i'm
confused by the syntax of your e-mail and the structure of the file in
question, as well as how you think it should be related to the notmuch
project.  This might all be obvious to other people; sorry for my confusion!

Do you think this should be integrated into notmuch and shipped with it?
 if so, can you provide it as a standard patch for folks here to review?

Some questions worth documenting if possible:

 * do you expect this to work for S/MIME encrypted messages as well as
S/MIME signed messages?

 * is there a reason to do this only in emacs?  PGP/MIME-signed (and
-encrypted) messages can be parsed directly by libnotmuch so they are
useful in other contexts as well

 * what key management model does this code assume and/or enforce?  how
do we know which keys belong to which users?

Thanks for working on notmuch!

Regards,

	--dkg


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 1010 bytes --]

Re: Smime signature verification in Notmuch - Emacs

[Baptiste]

[-- Attachment #1: Type: text/html, Size: 3211 bytes --]

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2335 bytes --]

Re: Smime signature verification in Notmuch - Emacs

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 2129 bytes --]

Hi Baptiste--

On 03/14/2014 06:58 AM, Baptiste wrote:

> firstly, sorry for my previous mail, you are right, it was broken. This one 
> should be better.

i didn't mean to imply it was broken at all.  i haven't tested it :)

> Truly, it would be better to implement it directly in notmuch core.

i agree with this.

> Signature verification just present a line with the signature owner and the 
> trust chain status (/green/ for good verification, /orange/ for self signed only 
> signature). No verification is made today against :From field.

what does "good verification" mean?  This seems to imply that there is a
trusted root store used.  how does the user configure this trust store?
 what about non-self-signed and unvalidated certificates? (e.g. certs by
unknown issuers, certs by known but untrusted issuers, certs with
unknown signature algorithms, certs without proper EKUs for creating
S/MIME signatures, etc.)

> (green)  [ Good signature by: bateast@bat.fr.eu.org - 08F4ED ]
> (orange) [ Good signature by key: 0x08F4ED self signed for bateast@bat.fr.eu.org ]

the use of 08F4ED here is a bit confusing.  i see from further below
that this refers to the serial number of the cert; but serial numbers
are not guaranteed to be unique (they are supposed to be unique across
issuers, but most root trust stores (and X.509 chains) can accept
certifications from different issuers).  what does displaying this
information do for the user?

> My opinion is that S/MIME is more and more widely used today, and then relying 
> only on gpg for signature or encryption is a bit rough.

I agree that S/MIME support would be nice; i think implementing it in
the notmuch core is the way to go.  fwiw, gmime already has a
cryptocontext that is supposed to handle S/MIME; it just needs proper
integration, similar to the PGP/MIME integration in notmuch core:

 https://developer.gnome.org/gmime/stable/GMimePkcs7Context.html

This has been on my plate for, uh, over a year now, but clearly i
haven't gotten to it, and would be happy if someone else wanted to pick
it up.

	--dkg


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 1010 bytes --]

Re: Smime signature verification in Notmuch - Emacs

[David Bremner]

Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes:
>
> I agree that S/MIME support would be nice; i think implementing it in
> the notmuch core is the way to go.  fwiw, gmime already has a
> cryptocontext that is supposed to handle S/MIME; it just needs proper
> integration, similar to the PGP/MIME integration in notmuch core:
>
>  https://developer.gnome.org/gmime/stable/GMimePkcs7Context.html
>
> This has been on my plate for, uh, over a year now, but clearly i
> haven't gotten to it, and would be happy if someone else wanted to pick
> it up.

Like Jamie did?

     id:1340995101-9616-1-git-send-email-jrollins@finestructure.net

Re: Smime signature verification in Notmuch - Emacs

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 1035 bytes --]

On 03/14/2014 02:08 PM, David Bremner wrote:
> Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes:
>>
>> I agree that S/MIME support would be nice; i think implementing it in
>> the notmuch core is the way to go.  fwiw, gmime already has a
>> cryptocontext that is supposed to handle S/MIME; it just needs proper
>> integration, similar to the PGP/MIME integration in notmuch core:
>>
>>  https://developer.gnome.org/gmime/stable/GMimePkcs7Context.html
>>
>> This has been on my plate for, uh, over a year now, but clearly i
>> haven't gotten to it, and would be happy if someone else wanted to pick
>> it up.
> 
> Like Jamie did?
> 
>      id:1340995101-9616-1-git-send-email-jrollins@finestructure.net

that message has an "ahem, dkg" -- it's waiting on me for something -- a
test suite, i guess?

sigh.  like i said, years and years.  if anyone wants to pass a test
suite for jamie's code, that'd be great.

(I'm S/MIME-signing this message with some wacky comodo cert out of
sheer perversity)

	--dkg


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3748 bytes --]