From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp11.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id aCYCOGDz82Fp7wAAgWs5BA (envelope-from ) for ; Fri, 28 Jan 2022 14:45:04 +0100 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp11.migadu.com with LMTPS id yIlpNWDz82HmiwAA9RJhRA (envelope-from ) for ; Fri, 28 Jan 2022 14:45:04 +0100 Received: from mail.notmuchmail.org (yantan.tethera.net [IPv6:2a01:4f9:c011:7a79::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 722FF2F9A3 for ; Fri, 28 Jan 2022 14:45:04 +0100 (CET) Received: from yantan.tethera.net (localhost [127.0.0.1]) by mail.notmuchmail.org (Postfix) with ESMTP id 054495F736; Fri, 28 Jan 2022 13:44:59 +0000 (UTC) X-Greylist: delayed 584 seconds by postgrey-1.36 at yantan; Fri, 28 Jan 2022 13:44:56 UTC Received: from che.mayfirst.org (unknown [162.247.75.117]) by mail.notmuchmail.org (Postfix) with ESMTPS id 5FD7D5F731 for ; Fri, 28 Jan 2022 13:44:56 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1643376909; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=TOh3OwZNrVFuJMKpGXdggZyKfqV+ZZzYHDeBPocCJjI=; b=DXEzTx6yIqGCvrY9HxrFIyUcJI4H9nILNKr2OaksXYXrAgxQAsYDjUb0FOZrX1j/sKUEP ebW+UBOXTWCGFkuCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1643376909; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=TOh3OwZNrVFuJMKpGXdggZyKfqV+ZZzYHDeBPocCJjI=; b=bf+T5RlwUGwUQ//fVsUCrs42JUs/lSoGI/m3lG1+/HsStPeMz0JSd0dhSvJoAz3VPbzmg nCdJPB1tyL/aqBTxDUFxMYoZGbplFAmd1umnTzuV7y56et6slB9c79sOksmJpKlP3kkUvvr i1UYy26hNd3GvLv0DlrRgrmsy4B2CC3cPku1p8cwVpg207v0IggbpywzLH9SneAhZgtpXSA UOsRpUusofow1xq5QeGt7hUIaf1QPQqef225sfAa565KxzJL7f7MH4zKoClKKegLIK5Tu1q Yrj0HIVYyudrJdm7ThsFTc8BE4554sQv+0izfmvbWmHSRX3yATSaWNj7GuwQ== Received: from fifthhorseman.net (lair.fifthhorseman.net [108.58.6.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id 966F2F9AC; Fri, 28 Jan 2022 08:35:06 -0500 (EST) Received: by fifthhorseman.net (Postfix, from userid 1000) id 7614720531; Thu, 27 Jan 2022 19:13:16 -0500 (EST) From: Daniel Kahn Gillmor To: Justus Winter , navse@mailbox.org, "notmuch@notmuchmail.org" Subject: certificate revocation checking for signed e-mail [was: Re: Emacs lagging for ~4min when opening from certain email.] In-Reply-To: <8735ldxp5i.fsf@europ.lan> References: <404620549.699733.1642996721419@office.mailbox.org> <8735ldxp5i.fsf@europ.lan> Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEX+i03xYJKwYBBAHaRw8BAQdACA4xvL/xI5dHedcnkfViyq84doe8zFRid9jW7CC9XBiI0QQf FgoAgwWCX+i03wWJBZ+mAAMLCQcJEOCS6zpcoQ26RxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNl cXVvaWEtcGdwLm9yZ/tr8E9NA10HvcAVlSxnox6z62KXCInWjZaiBIlgX6O5AxUKCAKbAQIeARYh BMKfigwB81402BaqXOCS6zpcoQ26AADZHQD/Zx9nc3N2kj13AUsKMr/7zekBtgfSIGB3hRCU74Su G44A/34Yp6IAkndewLxb1WdRSokycnaCVyrk0nb4imeAYyoPtBc8ZGtnQGZpZnRoaG9yc2VtYW4u bmV0PojRBBMWCgCDBYJf6LTfBYkFn6YAAwsJBwkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3Rh dGlvbnMuc2VxdW9pYS1wZ3Aub3JnL0Gwxvypz2tu1IPG+yu1zPjkiZwpscsitwrVvzN3bbADFQoI ApsBAh4BFiEEwp+KDAHzXjTYFqpc4JLrOlyhDboAAPkXAP0Z29z7jW+YzLzPTQML4EQLMbkHOfU4 +s+ki81Czt0WqgD/SJ8RyrqDCtEP8+E4ZSR01ysKqh+MUAsTaJlzZjehiQ24MwRf6LTfFgkrBgEE AdpHDwEBB0DkKHOW2kmqfAK461+acQ49gc2Z6VoXMChRqobGP0ubb4kBiAQYFgoBOgWCX+i03wWJ BZ+mAAkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jnfvo+ nHoxDwaLaJD8XZuXiaqBNZtIGXIypF1udBBRoc0CmwICHgG+oAQZFgoAbwWCX+i03wkQPp1xc3He VlxHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnaheiqE7Pfi3Atb3GGTw+ jFcBGOaobgzEJrhEuFpXREEWIQQttUkcnfDcj0MoY88+nXFzcd5WXAAAvrsBAIJ5sBg8Udocv25N stN/zWOiYpnjjvOjVMLH4fV3pWE1AP9T6hzHz7hRnAA8d01vqoxOlQ3O6cb/kFYAjqx3oMXSBhYh BMKfigwB81402BaqXOCS6zpcoQ26AADX7gD/b83VObe14xrNP8xcltRrBZF5OE1rQSPkMNy+eWpk eCwA/1hxiS8ZxL5/elNjXiWuHXEvUGnRoVj745Vl48sZPVYMuDgEX+i03xIKKwYBBAGXVQEFAQEH QIGex1WZbH6xhUBve5mblScGYU+Y8QJOomXH+rr5tMsMAwEICYjJBBgWCgB7BYJf6LTfBYkFn6YA CRDgkus6XKENukcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcEAx9vTD3b J0SXkhvcRcCr6uIDJwic3KFKxkH1m4QW0QKbDAIeARYhBMKfigwB81402BaqXOCS6zpcoQ26AAAX mwD8CWmukxwskU82RZLMk5fm1wCgMB5z8dA50KLw3rgsCykBAKg1w/Y7XpBS3SlXEegIg1K1e6dR fRxL7Z37WZXoH8AH Date: Thu, 27 Jan 2022 19:13:16 -0500 Message-ID: <87a6fgpvj7.fsf@fifthhorseman.net> MIME-Version: 1.0 Message-ID-Hash: 4XYE4G3SBWRMWH4ZHNM7MONW5RG5DD6F X-Message-ID-Hash: 4XYE4G3SBWRMWH4ZHNM7MONW5RG5DD6F X-MailFrom: dkg@fifthhorseman.net X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-notmuch.notmuchmail.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.3 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Content-Type: multipart/mixed; boundary="===============3643239014481954686==" X-Migadu-Flow: FLOW_IN X-Migadu-Country: DE ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1643377504; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:list-id:list-help: list-owner:list-unsubscribe:list-subscribe:list-post:dkim-signature:autocrypt:autocrypt; bh=a4xt83/RrMpSycArdlqKeXQVOn52HH/9Bcoelwn3EKc=; b=DlGD3kGrKi1N72uqQ+HaBpb81g5m950HN57MGPS6hT2k3zXdtZtsfSmFGy9/vydqWoG/O2 ybRALYxJITEURpKbhRavWr+/x6OARAqEGEQd+iV8N+TGoIWAhzy/aGlv8Pzx07et/Vf8ar 7N2LKQCW6Z3xaCZDz+ceh9OHx97VgPeUT4MG0sHhp5t6Jd+rCkMXBWedX4XbPH1NFCIkr3 nZiQLCfTP3Cv7mMf3kBXYMuwt/F/PdXfZW6fWequ70FNnXrb8t0j+7YQ63eV+AquodZ6sB KFfWaETLdrd4Epg0YBlxrE7waM9v8Dv1fnmOqBpY00jRMssID/mICFdAFNRhgw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1643377504; a=rsa-sha256; cv=none; b=W68ePkNdeLugsDyntb8YMAlWub0rsi8rSacMCDvr5tatMOMCjc4bVrGEfkYLzvbg1EaIZ2 BrNyyF14T4peeE36n7R+4+OadlLkysF47XVYhFocvGaKSWBqHxPWZ13kU5cQhwbFjtnkCB FPEtC7GDMcq34w0xqFfndOl5ID3Y/2QebogwFaGXXtvXoUmQwe/1kGYf3UxWL0aSNBjF34 qIdNRKJ9ViuBW59RGW02LlKEoKdG/qLHGgCRDVAiLlbX4ZqIqczmAWgPgWj+ZxnGjIVumP E8Z7uMRkHB9gpA31Kqr3tFpKH0JThun0rcE3u99F4o8/h1l7eoZB+piJRddRKQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("body hash did not verify") header.d=fifthhorseman.net header.s=2019 header.b=DXEzTx6y; dkim=fail ("body hash did not verify") header.d=fifthhorseman.net header.s=2019rsa header.b=bf+T5Rlw; dmarc=fail reason="SPF not aligned (relaxed)" header.from=fifthhorseman.net (policy=none); spf=pass (aspmx1.migadu.com: domain of notmuch-bounces@notmuchmail.org designates 2a01:4f9:c011:7a79::1 as permitted sender) smtp.mailfrom=notmuch-bounces@notmuchmail.org X-Migadu-Spam-Score: -3.84 Authentication-Results: aspmx1.migadu.com; dkim=fail ("body hash did not verify") header.d=fifthhorseman.net header.s=2019 header.b=DXEzTx6y; dkim=fail ("body hash did not verify") header.d=fifthhorseman.net header.s=2019rsa header.b=bf+T5Rlw; dmarc=fail reason="SPF not aligned (relaxed)" header.from=fifthhorseman.net (policy=none); spf=pass (aspmx1.migadu.com: domain of notmuch-bounces@notmuchmail.org designates 2a01:4f9:c011:7a79::1 as permitted sender) smtp.mailfrom=notmuch-bounces@notmuchmail.org X-Migadu-Queue-Id: 722FF2F9A3 X-Spam-Score: -3.84 X-Migadu-Scanner: scn0.migadu.com X-TUID: O9BOfexwou3f --===============3643239014481954686== Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" --=-=-= Content-Type: text/plain On Mon 2022-01-24 14:02:33 +0100, Justus Winter wrote: > navse@mailbox.org writes: > >> I have been using Notmuch with Emacs for a couple of days and it has >> been working great, except for when I open mails from a certain sender >> with S/MIME signed messages, Emacs will freeze up for about 4 minutes. >> Opening the expandable signature inside of the Email repeats the lag. > > Just to point you into the right direction, I'm pretty sure that this is > gpgsm reaching out to a network server, maybe to fetch certificate > revocation lists or something. I think Justus is on target about what the issue is here. GnuPG upstream appears to think that the privacy and latency costs of default revocation checking are an acceptable tradeoff: https://dev.gnupg.org/T3348 The S/MIME standard barely touches on revocation checking, and doesn't seem to mandate it or refuse it: https://www.rfc-editor.org/rfc/rfc8551.html The IETF LAMPS working group has adopted a document about guidance for end-to-end cryptographic protections for e-mail, which currently has a FIXME in the section about revocation checking: https://www.ietf.org/archive/id/draft-ietf-lamps-e2e-mail-guidance-02.html#name-checking-for-revocation I'm the original author and editor of that draft, and i would be *very* happy to get additional feedback/suggestions/contributed text about what folks think *should* be done here. If you might be interested in making a contribution, the LAMPS WG mailing list is spasm@ietf.org, or you can reply to me on this thread, or you can open issues or merge requests at https://gitlab.com/dkg/lamps-header-protection Arguably for notmuch, one of the ways to address this (or at least to amortize the costs) would be to cache the results of signature verification so that it doesn't happen for every message every time you view a thread. Presumably a cached sig verification could also skip over cert revocation checks. See id:87sgodxlk0.fsf@fifthhorseman.net on this mailing list (from me, Subject: "performance on long encrypted+signed threads" Date: 2019-09-30) for more discussion of the problem. Regrettably, i haven't made any progress on fixing it. --dkg --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQQttUkcnfDcj0MoY88+nXFzcd5WXAUCYfM1HAAKCRA+nXFzcd5W XN2GAP9glJuNC0CvAXNrh+Ze4Xj4KHtMM9IkoMZZgKIXjmQklQEAhce8+m8dKPXI OBc9kJAJdaCvjdONZssJ2atNU7WUXA4= =pbbv -----END PGP SIGNATURE----- --=-=-=-- --===============3643239014481954686== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3643239014481954686==--