Subject: RE: [Sip] S/MIME certificates question

From: "Mark Watson" <[email-masked]>
Date: Wed, 11 Sep 2002 15:44:03 +0100

Mike,

Well, I guess it's a MUST in the SIP spec (section quoted below), if you
assume that the 'it' in that sentence refers to the CMS SignedData message,
and not to the SIP message in which it (err, the CMS SignedData message) is
contained.

...Mark

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: 11 September 2002 15:28
> To: Watson, Mark [MOP:EP10:EXCH]
> Cc: [email-masked]'
> Subject: [Sip] S/MIME certificates question
> 
> 
> 
> Uh, unless it's actually a MUST in the S/MIME
> spec, there's no reason why the certificate has to
> be carried in the message. Certs are public data
> and can be fetched from any source, including... a
> (x.500) directory. In fact, I believe this would
> probably harm interoperability if you wanted to
> just use naked public keys since self-signed certs
> are much more likely to have agreement problems
> than just a naked key.
> 
> 	  Mike
> 
> Mark Watson writes:
>  > All,
>  > 
>  > In RFC3261 23.2 it states:
>  > 
>  > "Whenever the CMS SignedData message is used in S/MIME for 
> SIP, it MUST
>  > contain the certificate bearing the public key necessary 
> to verify the
>  > signature."
>  > 
>  > I assume that "it" refers to the CMS SignedData message.
>  > 
>  > An alternative would presumably be for the certificate to 
> be contained in a
>  > separate MIME part of type application/pks7-mime with
>  > smime-type="certs-only". This would have the advantage 
> that the certificate,
>  > which does not change often, and which I understand can be 
> fairly large,
>  > could make use of content indirection.
>  > 
>  > If the certificate is required to be embedded in the same 
> SignedData object
>  > as the signature itself, then I guess this would not be possible.
>  > 
>  > So, is inclusion of the certificate as a separate body 
> part, prohibited by
>  > the SIP specification ?
>  > 
>  > Regards...Mark
>  > 
>  > _______________________________________________
>  > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>  > This list is for NEW development of the core SIP Protocol
>  > Use [email-masked] for questions on current sip
>  > Use [email-masked] for new developments on the application of sip
>