Subject: RE: [Sip] S/MIME certificates question

From: "Mahey, Sonit" <[email-masked]>
Date: Wed, 11 Sep 2002 10:30:43 -0400

Hi All,

If SIP does not prohibit what Mark suggests, I think Mark's idea is good. I
like the notion of decoupling to the extent possible.

regards,
- sonit
Sonit Mahey,
Systems Architect,
Siemens Network Convergence,
*: 10 Technology Park Dr., Westford, MA 01886
': 978.923.3271
*: [email-masked] 
http://www.siemens.com

-----Original Message-----
From: Mark Watson [mailto:[email-masked]]
Sent: Wednesday, September 11, 2002 9:49 AM
To: [email-masked]'
Subject: [Sip] S/MIME certificates question

All,

In RFC3261 23.2 it states:

"Whenever the CMS SignedData message is used in S/MIME for SIP, it MUST
contain the certificate bearing the public key necessary to verify the
signature."

I assume that "it" refers to the CMS SignedData message.

An alternative would presumably be for the certificate to be contained in a
separate MIME part of type application/pks7-mime with
smime-type="certs-only". This would have the advantage that the certificate,
which does not change often, and which I understand can be fairly large,
could make use of content indirection.

If the certificate is required to be embedded in the same SignedData object
as the signature itself, then I guess this would not be possible.

So, is inclusion of the certificate as a separate body part, prohibited by
the SIP specification ?

Regards...Mark

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Sean Olson" <[email-masked]>
Date: Wed, 11 Sep 2002 08:59:51 -0700

This does make a great deal of sense. And I think it would be an
excellent
use of content indirection. Could someone clarify the purpose of the
"MUST"
in this text?

Cheers,
Sean Olson
Microsoft

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Mahey,
Sonit
Sent: Wednesday, September 11, 2002 7:31 AM
To: 'Mark Watson'; [email-masked]'
Cc: Sandhu, Hari
Subject: RE: [Sip] S/MIME certificates question

Hi All,

If SIP does not prohibit what Mark suggests, I think Mark's idea is
good. I like the notion of decoupling to the extent possible.

regards,
- sonit
Sonit Mahey,
Systems Architect,

-----Original Message-----
From: Mark Watson [mailto:[email-masked]]
Sent: Wednesday, September 11, 2002 9:49 AM
To: [email-masked]'
Subject: [Sip] S/MIME certificates question

All,

An alternative would presumably be for the certificate to be contained
in a separate MIME part of type application/pks7-mime with
smime-type="certs-only". This would have the advantage that the
certificate, which does not change often, and which I understand can be
fairly large, could make use of content indirection.

If the certificate is required to be embedded in the same SignedData
object as the signature itself, then I guess this would not be possible.

So, is inclusion of the certificate as a separate body part, prohibited
by the SIP specification ?

Regards...Mark

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip