Email Invitations

Encrypted email is becoming widespread. The PGP package [#!pgp!#] is widely used, and provides encryption capabilities that are strong enough for all except the most paranoid to sleep easy at night. PGP hasn't acquired the stamp of the IETF though - the IETF have produced their own secure mail standards in Privacy Enhanced Mail (PEM) and MIME Object Security Services (MOSS). But given the headstart that PGP has been given, the IETF standards may not be used in the wider world.

With the use of MIME objects encapsulated in secure mail, it is possible to send mail to individuals that will enable the receiver to start the conference applications automatically and securely. If someone wants to start a secure conference, she first collects the names and email addresses of everybody who will be invited. She then constructs the message, adding a specially delineated section that can be used to start the media receivers using the keys needed to decrypt the media, and on the selected address(es). She sends the mail out to everybody through her secure email agent, which encrypts, authenticates and adds integrity checks. The receivers get the email and pass it through their secure email agent to discover that its really from who they thought, and hasn't been tampered with. They then have the option of starting the session using the supplied key and address, or if their user agent has been enhanced, by simply clicking a button.

However, although secure email improves the scalability of issuing invitations, it still suffers from scalability problems, since a separate email must be sent out for each user. In sending the email, the public keys for the receivers must be found, and used, whilst at the receivers, the public key for the sender must be used to decrypt and authenticate the message. If these public keys are cached locally, then this is not too much of a performance problem, but if they must be obtained through the use of a public directory such as X.500, then the overhead in processing the message may be very high. In the case of a pay-per-view scenario, it is unlikely that the customers would be happy about receiving their keys so slowly.