Signed headers (was Re: Evolution signatures)

[Thomas Sjögren]

On Wed, Aug 06, 2003 at 06:33:33PM +1000, Ben Finney wrote:
> On 06-Aug-2003, Adrian 'Dagurashibanipal' von Bidder wrote:
> > Currently, I should best just delete those headers before looking at a
> > signed email - if I'm a serious paranoid, I should only look at the
> > information that is signed and suspect everything else to be fake. Of
> > course I don't do that...
> 
> I don't see that any of these headers are a good target for signing.

Since we already got Message-ID in the headers maybe something like a Host-ID
(think SSH) could help. The Host-ID could then be included in
your public key as a comment and be used like any other public key.

A sends B an encrypted mail with his/hers public key (with the Host-ID
fingerprint as a comment).
When B recieves a encrypted and/or signed mail (s)he checks the headers
for A's Host-ID. 

Sure, this doesn't come close to signing the headers and since everyone
can add any Host-ID with the help of extra headers the above example is pretty much
worthless but it might work given some time.

/Thomas
-- 
== thomas@northernsecurity.net | thomas@se.linux.org
== 3367 0D84 444B D5B6 980E 7D5D 1209 639D 114A A85C
--