1717063 - Update already imported OpenPGP keys automatically via WKD

Status: NEW

(MailNews Core :: Security: OpenPGP, enhancement)

Description

[Johannes König]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0

Steps to reproduce:

I use Thunderbird 78 with a corporate Web Key Directory.

Actual results:

When sending an encrypted email locally stored keys are used for encryption. However, even if keys for all recipients are found locally the information on these keys might be outdated: A key might have been revoked or its expiry properties might have changed.
This is relevant, however, because especially if a key has been compromised and therefore revoked it would be a severe security risk if I still use it to encrypt sensitive information.
Thus, if I want to be sure to use the correct keys for encryption I need to update the key information manually by triggering a WKD lookup before sending the message. This requires several manual steps and quickly becomes frustrating.
It would be very useful to automatically get information on the current state of the keys and, if necessary, update all keys associated to the email's recipients before sending the message.

Expected results:

A possible solution would be to automatically refresh keys while composing a message. The lookup should happen for all recipient addresses. If some of them are defined to be aliases then the lookup happens according to the alias definition. This functionality is similar to [1], but here we want to potentially update existing keys, not just discover new keys. Possible security concerns regarding automatic key lookup via WKDs and their alleviation have been laid out there, too.

Discovery of revocation certificates has also been discussed in [2].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1717056
[2] https://thunderbird.topicbox.com/groups/e2ee/T5fc012ddba7fabe6/discovering-compromised-keys-or-parcimonie-for-thunderbird