----- Original Message ---- From: Lex Spoon lex@lexspoon.org
Why did you pick SMIME rather than PGP, by the way? PGP seems to be better established, in part because it is not just for email.
I chose SMIME for several reasons: 1) OpenPGP support has already been started by Hans Martin Mosner and I didn't want to step on his work, since I didn't understand it. 2) I wanted to leverage the work we had done on ASN.1 and S/MIME uses CMS which is defined using ASN.1 3) Both Mac Email and MS Outlook provide S/MIME support by default. All you need do is add a Certificate, and you are encrypting and signing. I felt S/MIME had more installed base. 4) Most CAs issue Certificates in X509 format, used by SMIME 4) I was bored and I needed a project.
Would it be possible to support both S/MIME and PGP? I have defined a CertificateStore, which I persist on disk, in which I save the users private key, the user's certificates, and the recipients' Certificates for encrypting. Presumable PGP needs the same kind of info. I had read that the Certificate structure is different for PGP, so maybe that would be sufficient for differentiating between the two.
If we added SMIME to Celeste, it would become dependent on most of the Cryptography repository (http://www.squeaksource.com/Cryptography) - would that be ok? There would need to be some UI changes - when editing to mark an email for signing and/or encryption, and when receiving an email to display whether signed, encrypted, or both. It may make sense to have a header form and a body form, and the body form would be multipart aware. I dunno.
Rob