3 ms·
I'm currently writing software that essentially does this. It doesn't put the key in the SMTP protocol, but in the mail header, e.g. X-Purrcat-Key: ...publ
by cabalamat 13y ago
I'm currently writing software that essentially does this. It doesn't put the key in the SMTP protocol, but in the mail header, e.g.
X-Purrcat-Key: ...public key goes here....
- steveklabnik 13y agoPlease note that the X- pattern is considered deprecated: http://tools.ietf.org/html/rfc6648 http://tools.ietf.org/html/rfc6648 TL;DR: just make your header Purrcat-Key.
- cabalamat 13y agoThanks for the info.
- pjungwir 13y agoWell I commend you for moving things forward! Have you talked with any security professionals about possible pitfalls of using mail headers? I was sort of hoping tptacek would come on and tell me why my idea is no good. :-)
- cabalamat 13y agoNot yet, though the project will be open sourced, which will hopefully enable other people to catch any security holes I've left in it.
- RexM 13y agoThis seems like it would work if you wanted to encrypt a reply message, however how would you get another user's public key if you're the one initiating the first conversation?