* Smime signature verification in Notmuch - Emacs @ 2014-03-03 17:29 Baptiste 2014-03-11 18:03 ` Daniel Kahn Gillmor 0 siblings, 1 reply; 6+ messages in thread From: Baptiste @ 2014-03-03 17:29 UTC (permalink / raw) To: notmuch [-- Attachment #1: Type: text/plain, Size: 408 bytes --] Hi, I made a little ~Emacs~ advice for ~notmuch-show-insert-part-multipart/signed~ to deal with mails signed with /SMIME/ mechanism. It calls /openssl/ to create missing :sigstatus. Here it is : [[https://github.com/bateast/notmuch-openssl]] (it is an org-file, in ~Emacs~, use /org-babel-tangle/ on it to extract the .el). You are welcomed to make any comment. Thanks, -- : ~^v^~ Bat [-- Attachment #2.1.1: Type: text/html, Size: 657 bytes --] [-- Attachment #2.1.2: smime.p7s --] [-- Type: application/x-pkcs7-signature, Size: 2335 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Smime signature verification in Notmuch - Emacs 2014-03-03 17:29 Smime signature verification in Notmuch - Emacs Baptiste @ 2014-03-11 18:03 ` Daniel Kahn Gillmor 2014-03-14 10:58 ` Baptiste 0 siblings, 1 reply; 6+ messages in thread From: Daniel Kahn Gillmor @ 2014-03-11 18:03 UTC (permalink / raw) To: Baptiste, notmuch [-- Attachment #1: Type: text/plain, Size: 1392 bytes --] Hi Baptiste-- On 03/03/2014 12:29 PM, Baptiste wrote: > I made a little |Emacs| advice for |notmuch-show-insert-part-multipart/signed| > to deal with mails signed with /SMIME/ mechanism. It calls /openssl/ to create > missing :sigstatus. > > Here it is : https://github.com/bateast/notmuch-openssl > (it is an org-file, in |Emacs|, use /org-babel-tangle/ on it to extract the .el). > > You are welcomed to make any comment. i'm interested in the functionality you're describing, but i confess i'm confused by the syntax of your e-mail and the structure of the file in question, as well as how you think it should be related to the notmuch project. This might all be obvious to other people; sorry for my confusion! Do you think this should be integrated into notmuch and shipped with it? if so, can you provide it as a standard patch for folks here to review? Some questions worth documenting if possible: * do you expect this to work for S/MIME encrypted messages as well as S/MIME signed messages? * is there a reason to do this only in emacs? PGP/MIME-signed (and -encrypted) messages can be parsed directly by libnotmuch so they are useful in other contexts as well * what key management model does this code assume and/or enforce? how do we know which keys belong to which users? Thanks for working on notmuch! Regards, --dkg [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 1010 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Smime signature verification in Notmuch - Emacs 2014-03-11 18:03 ` Daniel Kahn Gillmor @ 2014-03-14 10:58 ` Baptiste 2014-03-14 15:14 ` Daniel Kahn Gillmor 0 siblings, 1 reply; 6+ messages in thread From: Baptiste @ 2014-03-14 10:58 UTC (permalink / raw) To: Daniel Kahn Gillmor, notmuch [-- Attachment #1: Type: text/html, Size: 3211 bytes --] [-- Attachment #2: smime.p7s --] [-- Type: application/x-pkcs7-signature, Size: 2335 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Smime signature verification in Notmuch - Emacs 2014-03-14 10:58 ` Baptiste @ 2014-03-14 15:14 ` Daniel Kahn Gillmor 2014-03-14 18:08 ` David Bremner 0 siblings, 1 reply; 6+ messages in thread From: Daniel Kahn Gillmor @ 2014-03-14 15:14 UTC (permalink / raw) To: Baptiste, notmuch [-- Attachment #1: Type: text/plain, Size: 2129 bytes --] Hi Baptiste-- On 03/14/2014 06:58 AM, Baptiste wrote: > firstly, sorry for my previous mail, you are right, it was broken. This one > should be better. i didn't mean to imply it was broken at all. i haven't tested it :) > Truly, it would be better to implement it directly in notmuch core. i agree with this. > Signature verification just present a line with the signature owner and the > trust chain status (/green/ for good verification, /orange/ for self signed only > signature). No verification is made today against :From field. what does "good verification" mean? This seems to imply that there is a trusted root store used. how does the user configure this trust store? what about non-self-signed and unvalidated certificates? (e.g. certs by unknown issuers, certs by known but untrusted issuers, certs with unknown signature algorithms, certs without proper EKUs for creating S/MIME signatures, etc.) > (green) [ Good signature by: bateast@bat.fr.eu.org - 08F4ED ] > (orange) [ Good signature by key: 0x08F4ED self signed for bateast@bat.fr.eu.org ] the use of 08F4ED here is a bit confusing. i see from further below that this refers to the serial number of the cert; but serial numbers are not guaranteed to be unique (they are supposed to be unique across issuers, but most root trust stores (and X.509 chains) can accept certifications from different issuers). what does displaying this information do for the user? > My opinion is that S/MIME is more and more widely used today, and then relying > only on gpg for signature or encryption is a bit rough. I agree that S/MIME support would be nice; i think implementing it in the notmuch core is the way to go. fwiw, gmime already has a cryptocontext that is supposed to handle S/MIME; it just needs proper integration, similar to the PGP/MIME integration in notmuch core: https://developer.gnome.org/gmime/stable/GMimePkcs7Context.html This has been on my plate for, uh, over a year now, but clearly i haven't gotten to it, and would be happy if someone else wanted to pick it up. --dkg [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 1010 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Smime signature verification in Notmuch - Emacs 2014-03-14 15:14 ` Daniel Kahn Gillmor @ 2014-03-14 18:08 ` David Bremner 2014-03-14 18:12 ` Daniel Kahn Gillmor 0 siblings, 1 reply; 6+ messages in thread From: David Bremner @ 2014-03-14 18:08 UTC (permalink / raw) To: Daniel Kahn Gillmor, Baptiste, notmuch Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes: > > I agree that S/MIME support would be nice; i think implementing it in > the notmuch core is the way to go. fwiw, gmime already has a > cryptocontext that is supposed to handle S/MIME; it just needs proper > integration, similar to the PGP/MIME integration in notmuch core: > > https://developer.gnome.org/gmime/stable/GMimePkcs7Context.html > > This has been on my plate for, uh, over a year now, but clearly i > haven't gotten to it, and would be happy if someone else wanted to pick > it up. Like Jamie did? id:1340995101-9616-1-git-send-email-jrollins@finestructure.net ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Smime signature verification in Notmuch - Emacs 2014-03-14 18:08 ` David Bremner @ 2014-03-14 18:12 ` Daniel Kahn Gillmor 0 siblings, 0 replies; 6+ messages in thread From: Daniel Kahn Gillmor @ 2014-03-14 18:12 UTC (permalink / raw) To: David Bremner, Baptiste, notmuch [-- Attachment #1: Type: text/plain, Size: 1035 bytes --] On 03/14/2014 02:08 PM, David Bremner wrote: > Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes: >> >> I agree that S/MIME support would be nice; i think implementing it in >> the notmuch core is the way to go. fwiw, gmime already has a >> cryptocontext that is supposed to handle S/MIME; it just needs proper >> integration, similar to the PGP/MIME integration in notmuch core: >> >> https://developer.gnome.org/gmime/stable/GMimePkcs7Context.html >> >> This has been on my plate for, uh, over a year now, but clearly i >> haven't gotten to it, and would be happy if someone else wanted to pick >> it up. > > Like Jamie did? > > id:1340995101-9616-1-git-send-email-jrollins@finestructure.net that message has an "ahem, dkg" -- it's waiting on me for something -- a test suite, i guess? sigh. like i said, years and years. if anyone wants to pass a test suite for jamie's code, that'd be great. (I'm S/MIME-signing this message with some wacky comodo cert out of sheer perversity) --dkg [-- Attachment #2: S/MIME Cryptographic Signature --] [-- Type: application/pkcs7-signature, Size: 3748 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-03-14 18:12 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-03-03 17:29 Smime signature verification in Notmuch - Emacs Baptiste 2014-03-11 18:03 ` Daniel Kahn Gillmor 2014-03-14 10:58 ` Baptiste 2014-03-14 15:14 ` Daniel Kahn Gillmor 2014-03-14 18:08 ` David Bremner 2014-03-14 18:12 ` Daniel Kahn Gillmor
Code repositories for project(s) associated with this public inbox https://yhetil.org/notmuch.git/ This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).