Subject: [Sip] S/MIME certificates question

From: "Mark Watson" <[email-masked]>
Date: Wed, 11 Sep 2002 14:49:13 +0100

All,

In RFC3261 23.2 it states:

"Whenever the CMS SignedData message is used in S/MIME for SIP, it MUST
contain the certificate bearing the public key necessary to verify the
signature."

I assume that "it" refers to the CMS SignedData message.

An alternative would presumably be for the certificate to be contained in a
separate MIME part of type application/pks7-mime with
smime-type="certs-only". This would have the advantage that the certificate,
which does not change often, and which I understand can be fairly large,
could make use of content indirection.

If the certificate is required to be embedded in the same SignedData object
as the signature itself, then I guess this would not be possible.

So, is inclusion of the certificate as a separate body part, prohibited by
the SIP specification ?

Regards...Mark

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Wed, 11 Sep 2002 07:27:35 -0700 (PDT)

Uh, unless it's actually a MUST in the S/MIME
spec, there's no reason why the certificate has to
be carried in the message. Certs are public data
and can be fetched from any source, including... a
(x.500) directory. In fact, I believe this would
probably harm interoperability if you wanted to
just use naked public keys since self-signed certs
are much more likely to have agreement problems
than just a naked key.

	  Mike