Subject: Re: to be done

From: "John W. Noerenberg" <[email-masked]>
Date: Thu, 18 Feb 1999 12:25:34 -0800

At 10:49 PM +0100 1/26/99, Thomas Roessler wrote:
> Since things don't look like we are ever getting the minutes from
> the IETF meeting, I'd like to give a push for some work which should
> be done by this WG.
>
> - Revise RFC 2015.  I'm hearing that the agreement in Orlando was to
>   do some small changes.  While this isn't interesting or anything,
>   it should be done.

Yes.

>
> - Define a multiple signature protocol. There are essentially two
>   possible paths to go.  On the one hand, we may define a
>   multipart/mixed protocol as suggested by Michael Elkins, or we may
>   just extend the current multipart/signed.  Personally, I'm in
>   favor of the fist approach.

Write up the motivation for multiple signatures, and publish it to 
the list.  Since reconciling handling of multiple signatures is one 
of the issues raised in concern with 2015, a separate protocol is a 
reasonable way to attack the problem.  What are other opinions on 
settling this?

We will not meet in Minneapolis.  I hope y'all aren't greatly 
disappointed.  I will stand in the email stocks so you can sling your 
rocks and arrows.

I do want to meet in Oslo so we can consider 2015 revisions, and 
perhaps the multiple signature protocol if we decide that is best 
course.  This means it would be good to have a 2015 revision and some 
debate over it in time for the that meeting.  More on this soon.

best,

john noerenberg
[email-masked]
  ----------------------------------------------------------------------
  The man that can most truly be accounted brave is he who best
  knows the meaning of what is sweet in life and what is terrible,
  and then goes out undeterred to meet what is to come.
  -- Pericles, "Funeral Oration", 479 B.C.
  ----------------------------------------------------------------------

---

From: Thomas Roessler <[email-masked]>
Date: Thu, 18 Feb 1999 22:09:13 +0100

On 1999-02-18 12:25:34 -0800, John  W. Noerenberg wrote:

> the list.

Generally, it may be practical to have the possibility to have
multiple entities same one and the same document.  Possible
applications include:

- Transit periods in which one person is using multiple signature
  keys and wants to make sure that every recipient can verify a
  signature.

- Four-eye-principle: Messages may have to be revised and signed by
  two or more persons to be considered valid.  Multiple signatures
  give a simple implementation of this.

- Multi-protocol signatures: A message may be signed with different
  algorithms or protocols, e.g., MOSS, S/MIME, and PGP/MIME.

There seem to be essentially three different solutions from a PGP
point of view:

- Put multiple signature packets into the application/pgp-signature
  part of a multipart/signed; protocol=pgp-signature body.  I have
  not tested this.  It may or may not work, and it doesn't satisfy
  application 3, as it's PGP specific.

- Permit multiple application/pgp-signature parts in a mult/sign;
  prot=pgp-sig body.  This would be an extension of RFC 1847, it
  would be simple, but it would be PGP-specific once again.

- Define a multipart/mixed protocol in the spirit of RFC 1847.  This
  would not require any changes to RFC 1847, and it would be usable
  for all applications I listed above.

  I prefer this solution for the reason that it is not specific to
  any of the underlying signature protocols.  Modifications to MUAs
  to support this on the receiving side are minimal if these MUAs
  are able to handle multi-level MIME structures.  I've done a
  testbed implementation in the unstable tree of the Mutt MUA.

For the details of this protocol, see Michael Elkins' message from
Tue, 1 Dec 1998 17:15:18 -0800 to this list.  

tlr
-- 
http://home.pages.de/~roessler/