Subject: RE: SMIME Capabilities in X.509 certificates.

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 27 Apr 2004 21:35:27 +0100

OK Steve.

Let me try to recap this issue and see if we at least can get to a
debate whether this is worth doing or not.

The issue on the table is whether it should be a standardized option to
include the SMIME capability attribute in a certificate.

Microsoft is currently supporting inclusion of this attribute in
certificates using the standard PKCS#9 OID as extension OID and thus
using the standard PKCS#9 attribute syntax as extension syntax.

This extension, when present in certificates is used as the last
resource to figure out the appropriate configuration/capabilities of an
S/MIME opponent before falling back to default configuration for unknown
users.

This is useful in particular when an encrypted e-mail is sent to a
recipient whose certificate is known but where the recipient's
capabilities otherwise are unknown. 

But if there is a known previous S/MIME message from the recipient from
which the recipient's capabilities can be extracted, the certificate
extension would typically be ignored.

The underlying rationale for this is that in a store and forward type of
communication such as e-mail, we may run into situation where one party
need to guess the capabilities of the opponent and the guiding principle
is that the more information we can use to make the best guess, the
better it is.

Using such SMIMECapabilities extension in certificates as the last
resource of information is supporting that rationale.

So, again, please state your opinion so we can either do this or put it
away. If it is to be done, the task should be very simple since there
should be no reason to deviate from the current syntax of the
SMIMECapabilities attribute used in S/MIME.

Stefan Santesson
Program Manager, Windows Security

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: den 9 april 2004 10:34
> To: Stefan Santesson
> Cc: [email-masked]
> Subject: Re: SMIME Capabilities in X.509 certificates.
> 
> Stefan,
> 
> There have been no responses on the list to your proposal. I think it
> would help to give examples of what sorts of info you envision in the
> extension, starting with what MS has put in certs under using this
> extension. Also note that this might be the topic of a separate RFC,
> or part of a 3280 update, but not a new work item unless the
> cognizant AD agrees.
> 
> Steve

---

From: "David A. Cooper" <[email-masked]>
Date: Thu, 29 Apr 2004 13:58:33 -0400

Stefan,

Given that SMIMECapabilities is an Attribute, why not put it in the 
SubjectDirectoryAttributes extension rather than trying to treat it as a 
certificate extension?

It's not clear to me how this extension would be populated.  How does 
the CA know the S/MIME capabilities of the certificate subject?  Does 
the CA assume that the capabilities are the same for all of its 
subscribers or does the subscriber specify this information in the 
certificate request?  The CA can't populate the attribute on its own 
unless it really knows what e-mail client software every subscriber is 
using.  Otherwise the contents of the attribute wouldn't be very 
useful.  In theory, the contents of the attribute could reflect the 
capabilities of the subscriber if the subscriber specified the 
contents.  But, I don't see how this would work in practice unless the 
subscriber's e-mail client generated the certificate request, which 
doesn't seem realistic.

Besides, if the information in the SMIMECapabilities attribute is only 
of use to S/MIME clients, shouldn't this be an S/MIME working group 
consideration rather than PKIX?

Dave

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 29 Apr 2004 15:47:18 -0400

David:

Would supportedAlgorithms be a better field to add?  It is a directory
attribute, but could be added as a certificate extension.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David A. Cooper
Sent: Thursday, April 29, 2004 1:59 PM
To: Stefan Santesson
Cc: [email-masked]
Subject: Re: SMIME Capabilities in X.509 certificates.

Stefan,

Dave

Stefan Santesson wrote:

>S/MIME opponent before falling back to default configuration for 
>unknown users.
>
>The underlying rationale for this is that in a store and forward type 
>of communication such as e-mail, we may run into situation where one 
>party need to guess the capabilities of the opponent and the guiding 
>principle is that the more information we can use to make the best 
>guess, the better it is.
>