Subject: RE: [Sip] S/MIME certificates question

From: "Mark Watson" <[email-masked]>
Date: Thu, 12 Sep 2002 10:33:47 +0100

If there is agreement about the interpretation of this 'MUST', along the
lines that Jon suggests below, is there any way we can clarify this in a
specification ? For example by providing an example somewhere in which the
cert is in a separate MIME body & not in the CMS SignedData ? Perhaps in the
eventual Content Indirection specification ?

[It seems there is some discussion about whether the MUST should be there
*at all*, which is a separate issue. My suggestion above is based on the
fact that it IS there in RFC3261 & we should clarify how it should be
(re)interpreted.]

...Mark

> -----Original Message-----
> From: Peterson, Jon [mailto:[email-masked]]
> Sent: 11 September 2002 20:48
> To: Watson, Mark [MOP:EP10:EXCH]; [email-masked]'
> Subject: RE: [Sip] S/MIME certificates question
> 
> 
> 
> Our intention was not to rule out things like content 
> indirection, although
> at the time we didn't understand SIP-based content 
> indirection well enough
> to make special allowances for it. The MUST is present, as 
> Mark conjectures,
> in order to ensure that the cert will be available to the 
> destination, not
> to dictate any particular manner in which it must be made 
> available. I think
> the use of content indirection meets the spirit, if not 
> exactly the letter,
> of the passage quoted below.
> 
> Jon Peterson
> NeuStar, Inc.
> 
> > -----Original Message-----
> > From: Mark Watson [mailto:[email-masked]]
> > Sent: Wednesday, September 11, 2002 6:49 AM
> > To: [email-masked]'
> > Subject: [Sip] S/MIME certificates question
> > 
> > 
> > All,
> > 
> > In RFC3261 23.2 it states:
> > 
> > "Whenever the CMS SignedData message is used in S/MIME for 
> > SIP, it MUST
> > contain the certificate bearing the public key necessary to 
> verify the
> > signature."
> > 
> > I assume that "it" refers to the CMS SignedData message.
> > 
> > An alternative would presumably be for the certificate to be 
> > contained in a
> > separate MIME part of type application/pks7-mime with
> > smime-type="certs-only". This would have the advantage that 
> > the certificate,
> > which does not change often, and which I understand can be 
> > fairly large,
> > could make use of content indirection.
> > 
> > If the certificate is required to be embedded in the same 
> > SignedData object
> > as the signature itself, then I guess this would not be possible.
> > 
> > So, is inclusion of the certificate as a separate body part, 
> > prohibited by
> > the SIP specification ?
> > 
> > Regards...Mark
> > 
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments on the application of sip
> > 
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 12 Sep 2002 14:56:02 -0400

Mark Watson wrote:
> specification ? For example by providing an example somewhere in which 
> the cert is in a separate MIME body & not in the CMS SignedData ? 
> Perhaps in the eventual Content Indirection specification ?

I'll log this in bugzilla for clarification.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com