Subject: End-to-end securety for web and e-mail ?

From: Rob J Meijer <[email-masked]>
Date: Tue, 17 Aug 1999 08:44:59 +0200 (CEST)

After looking extensively at many drafts and rfc's, and triing some
workgroup mailinglist that aparently already died I now hesitantly
permit myself to pose this question on 'this' mailinglist.

I can find information on point to point securety issues being adressed 
for web, for e-mail and for other traffic, but aparantly none that
adresses end to end securety of sensitive information that passes truegh
multiple systems to get from endpoint to endpoint.
If for example a HTTP POST is used there are meganism's to secure the HTTP
post, but on the server itself the information is completely available,
some of the variables posted might be needed by the program processing the
HTTP POST, others may however hold information that should not be
available to the processing program, but only to the end-point of the
communication.  

Is there any document or workgroup currently adressing this issue? 

T.I.A.

Rob J Meijer

---

From: Dave Crocker <[email-masked]>
Date: Tue, 17 Aug 1999 00:10:25 -0700

>Is there any document or workgroup currently adressing this issue?

openpgp and s/mime.

d/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Dave Crocker                                         Tel: +1 408 246 8253
Brandenburg Consulting                               Fax: +1 408 273 6464
675 Spruce Drive                             <http://www.brandenburg.com>
Sunnyvale, CA 94086 USA                 <mailto:[email-masked]>

---

From: Stephen Kent <[email-masked]>
Date: Tue, 17 Aug 1999 09:45:36 -0400

Rob,

S/MIME does address end-to-end security for e-mail, protecting messages as
they pass through intermediate mail relays and while sitting on a POP or
IMAP server weaiting to be retrieved by recipients.

For web protection that extends to data sitting on a server, the
appropriate technology would have been S-HTTP, but it lost the battle with
SSL several years ago.  Also, because most web pages are now constructed
dynamicaly, even S-HTTP would not be able to provide much help.

Steve

---

From: Rob J Meijer <[email-masked]>
Date: Tue, 17 Aug 1999 16:40:42 +0200 (CEST)

So an extention on the HTTP post definition that would allow part of the
variables to be exchanged in plain and part of them encapsulated in some
form of S/MIME bodyparts would be needed to acomplish end to end
protection of data that was submitted truegh SSL protected HTTP posts?
That way the parts of the request needed for the dynamic info generated on
the webserver would be available to the server, but parts needed by the
actual information endpoint could stay protected untill they reached their
destination.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 17 Aug 1999 10:54:56 -0400

Rob,

>actual information endpoint could stay protected untill they reached their

That would be in the flavor of S-HTTP, but more complex, and updated to use
the CMS facility of S/MIME, vs. the PEM-based constructs from years ago.
Mixing protected and unprotected data types in the application data stream
could get rather hairy, but ...

Steve

---

From: John C Klensin <[email-masked]>
Date: Tue, 17 Aug 1999 11:22:11 -0400

--On Tuesday, 17 August, 1999, 16:40 +0200 Rob J Meijer
<[email-masked]> wrote:

> So an extention on the HTTP post definition that would allow
> part of the variables to be exchanged in plain and part of
> them encapsulated in some form of S/MIME bodyparts would be
> needed to acomplish end to end protection of data that was
> submitted truegh SSL protected HTTP posts? That way the parts
> of the request needed for the dynamic info generated on the
> webserver would be available to the server, but parts needed
> by the actual information endpoint could stay protected untill
> they reached their destination.

Yes.  Of course, if the important stuff were protected with an
end-to-end technique, you might not need SSL.  And that might,
at least, improve performance at bit.

You are about to reinvent S-HTTP, incidentally.

    john

---

From: Dave Crocker <[email-masked]>
Date: Tue, 17 Aug 1999 08:26:49 -0700

>protection of data that was submitted truegh SSL protected HTTP posts?

Both OpenPGP and S/MIME encapsulate MIME data objects.  Hence, if you 
already have a MIME environment -- and both HTTP and Internet Mail do -- 
you just need to use it to send security data according to the technology 
of your choice (both are standards track.)

Hence the issue is not standards or mechanism, per se, but knowing what 
your clients' systems support.  This is the same issue for deciding about 
ANY data type to send or post.

d/