Re: Thoughts on an OpenPGP header?
On Fri, 03 Dec 2004 18:16:03 +0100, Simon Josefsson said:
> could be retrieved, and 'gpg --import' is invoked on it. Another is a
> "Secure reply" button, that uses the Key ID information in the header,
> to make a signed/encrypted reply to a message.
I don't think that this is a good idea. Mutt should default to an
encrypted reply if a encrypted message is replied to. The keyID to
encrypt to may then be taken either from the signature of the message
(most messages are encrypted and signed) or from the list of
recipients the orginal mssage has been encrypted too. The latter
poses a security problem because an attacker might have added an
additional recipient with a random session ID.
The PGP header is still useful as a hint on where to get an updated
key for non-signed messages in case of keyserver problems. That is
useful if you want to reply encrypted on a non-encrypted message.
Salam-Shalom,
Werner