On 04/20/2017 05:40 PM, Paul Wouters wrote:
On Thu, 20 Apr 2017, Rui Costa wrote:So, can someone point me to some URL/documentation/https://mailarchive.ietf.org/arch/msg/ietf/xyz explaining the point on having keys/cryptography somewhere in between these 2 end points? (And thus i guess i'm saying i don't understand cryptography's point on scenarios other than what i think people have called on these threads "E2E".)I want to send you an encrypted email. I need your key. I can send a plaintext email asking you for the key. I have to hope that it really reached you and that it is you who gave me the key and that the key was not modified in transport.
You send me a signed email from a mutually trusted source. I now have your public key, because you can extract it from the signed S/MIME email. (I am guessing you can do this with PGP.)
I can now send you an encrypted email, and it includes my public key, so you can decrypt it.
There are free email cert companies. This email is signed by one (unless the list server strips them out like it used to). Your MUA now knows my public key.
-- Doug Royer - (http://DougRoyer.US http://goo.gl/yrxJTu ) DouglasRoyer@xxxxxxxxx 714-989-6135
<<attachment: smime.p7s>>