On 17 Sep 2013 15:47, "Christoph Gruber" <gr...@guru.at> wrote: > > On 2013-09-16 Phillip Hallam-Baker <hal...@gmail.com> wrote: > [snip] >> >> If people are sending email through the corporate email system then in many cases the corporation has a need/right to see what they are sending/receiving. > > [snip] > > Even if an organisation has a need/right to look into people's email, it is necessary to protect the communication on transport and storage. Of course a certain way of key recovery has to be in place. > > Just my 2 cents
I intend to reply in more detail to the draft there's lots of very interesting work there. The most common approach to ILM for email in highly regulated sectors I've seen is to divorce the storage and transport mechanism and associated security from the long term storage. In a corporate environment the message is captured pre encryption and transmission and stored. Whilst key escrow mechanisms do exist the risk is that what gets escrowed isn't what was sent if you maliciously want to tunnel data (imagine not being able to decrypt a message at the request of the SEC or FSA because the key you were sent is wrong by the desktop app, or conversely having to decrypt everything first to check). You have the added issue of having to store all the associated keys and in 7 years (the typical retention period over here for business now regarded as complete, let alone long running contracts still in play) still have software to decrypt it. Hence, store in the clear, keep safe at rest using today's archival mechanism and when that starts to get dated move onto the next one en-masse, for all your media not just emails. Hence for the purposes of your RFC perhaps view that as a problem that doesn't require detailed specification. M > >> -- >> Website: http://hallambaker.com/ >> >> _______________________________________________ >> The cryptography mailing list >> cryptography@metzdowd.com >> http://www.metzdowd.com/mailman/listinfo/cryptography > > > _______________________________________________ > The cryptography mailing list > cryptography@metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography
_______________________________________________ The cryptography mailing list cryptography@metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography
