Subject: [VCARDDAV] New vCard property for S/MIME capabilities

From: Alexey Melnikov <[email-masked]>
Date: Fri, 14 Jun 2013 17:59:55 +0100

Hi,
Sean Turner, Carl Wallace and I wrote a new draft defining S/MIME 
capabilities as a vCard property. The idea is to be able to bootstrap 
S/MIME by looking at a vCard:

http://tools.ietf.org/html/draft-turner-vcard-smimecaps-00

We would be interested in hearing feedback on this idea.

Thanks,
Alexey

---

From: Cyrus Daboo <[email-masked]>
Date: Fri, 14 Jun 2013 13:15:09 -0400

Hi Alexey,

> We would be interested in hearing feedback on this idea.

Your spec allows the SMIME capabilities information to be included as an 
extension in a public key. Since vCard already has a way for a public key 
to be included (via the KEY property) why have a separate property, given 
that if someone is using S/MIME they will likely have their public key in 
the vCard anyway?

-- 
Cyrus Daboo

---

From: Cyrus Daboo <[email-masked]>
Date: Fri, 14 Jun 2013 13:42:00 -0400

Hi Carl,

--On June 14, 2013 at 1:31:48 PM -0400 Carl Wallace 
<[email-masked]> wrote:

> The public key will be in the vCard but many PKIs do not use the S/MIME
> capabilities extension, so there's a (relatively large) gap.  S/MIME
> capabilities may change independent of certificate issuance lifecycle, so
> not baking the setting into a certificate and instead placing it in a
> vCard may be preferable.

But are you expecting users to know when their SMIME capabilities change? 
Probably not. But even if that vCard data were generated automatically are 
we really expecting updated vCards to be sent out for everyone hosted by a 
particular mail system using S/MIME? In all likelihood I would expect that 
it would always be better to have a URI value where the current 
capabilities can be downloaded, rather than storing "static" data directly 
in the vCard.

-- 
Cyrus Daboo

---

From: Carl Wallace <[email-masked]>
Date: Fri, 14 Jun 2013 13:56:32 -0400

>But are you expecting users to know when their SMIME capabilities change?

Generally, no.  Nor do I expect users to know SMIME capabilities could
appear in their certificate or how to request inclusion of the extension
in a certificate.

>particular mail system using S/MIME?

There are large repositories of vCards available today.  In many cases,
the vCards are retrieved solely to obtain an encryption certificate.  The
proposal is to augment the vCard definition to add support so the S/MIME
capabilities are learned at the same time the certificate is retrieved.
Were there a change from one algorithm to another across an enterprise, I
do not think it unreasonable that vCards would be updated in bulk.

>In all likelihood I would expect that

That may have been a better approach for the certificates, which are
relatively difficult to update.  If this were made indirect, I'd expect
the S/MIME capabilities to be obtained when the vCard was obtained; I
don't see any reason to require network access to determine these
capabilities.  It's not like encryption algorithms change all that
frequently.  If you did resolve the reference at download time, you'd
still need some means of representing the data, such as what this spec
defines.

---

From: Carl Wallace <[email-masked]>
Date: Fri, 14 Jun 2013 13:31:48 -0400