Subject: RE: [Sip] S/MIME certificates question

From: "Mark Watson" <[email-masked]>
Date: Wed, 11 Sep 2002 17:57:44 +0100

I guess I can see why you "MUST" include the certificate in the SIP message,
as you have no way of knowing whether the receiver has any other way to get
it. The question is whether it MUST be in the same CMS SignedData structure
as the signature itself, or wherther it could be in another MIME body part,
where it could be indirected.

Note that if you use indirection, you still have no idea whether the
receiver has any way to get the data. But it is a requirement of the
indirection mechanism that it can fall back to in-line carriage of the data,
if the receiver doesn't support indirection or the URI scheme provided. At
least this is what I thought - Sean can correct me if I'm wrong!

...Mark

> -----Original Message-----
> From: Sean Olson [mailto:[email-masked]]
> Sent: 11 September 2002 17:00
> To: 'Mahey, Sonit'; Watson, Mark [MOP:EP10:EXCH]; [email-masked]
> Cc: 'Sandhu, Hari'
> Subject: RE: [Sip] S/MIME certificates question
> 
> 
> This does make a great deal of sense. And I think it would be an
> excellent
> use of content indirection. Could someone clarify the purpose of the
> "MUST"
> in this text?
> 
> Cheers,
> Sean Olson
> Microsoft
> 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Mahey,
> Sonit
> Sent: Wednesday, September 11, 2002 7:31 AM
> To: 'Mark Watson'; [email-masked]'
> Cc: Sandhu, Hari
> Subject: RE: [Sip] S/MIME certificates question
> 
> 
> Hi All,
> 
> If SIP does not prohibit what Mark suggests, I think Mark's idea is
> good. I like the notion of decoupling to the extent possible.
> 
> regards,
> - sonit
> Sonit Mahey,
> Systems Architect,
> Siemens Network Convergence,
> *: 10 Technology Park Dr., Westford, MA 01886
> ': 978.923.3271
> *: [email-masked] 
> http://www.siemens.com
> 
> 
> -----Original Message-----
> From: Mark Watson [mailto:[email-masked]]
> Sent: Wednesday, September 11, 2002 9:49 AM
> To: [email-masked]'
> Subject: [Sip] S/MIME certificates question
> 
> 
> All,
> 
> In RFC3261 23.2 it states:
> 
> "Whenever the CMS SignedData message is used in S/MIME for 
> SIP, it MUST
> contain the certificate bearing the public key necessary to verify the
> signature."
> 
> I assume that "it" refers to the CMS SignedData message.
> 
> An alternative would presumably be for the certificate to be contained
> in a separate MIME part of type application/pks7-mime with
> smime-type="certs-only". This would have the advantage that the
> certificate, which does not change often, and which I 
> understand can be
> fairly large, could make use of content indirection.
> 
> If the certificate is required to be embedded in the same SignedData
> object as the signature itself, then I guess this would not 
> be possible.
> 
> So, is inclusion of the certificate as a separate body part, 
> prohibited
> by the SIP specification ?
> 
> Regards...Mark
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip Use
> [email-masked] for new developments on the application of sip
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip Use
> [email-masked] for new developments on the application of sip
> 
>

---

From: Michael Thomas <[email-masked]>
Date: Wed, 11 Sep 2002 10:16:22 -0700 (PDT)

> where it could be indirected.

   That's only the start of your problems. Even if you
   send a cert, you have no idea whether the other side
   trusts the cert's signing root. Nor without any
   prior contact are you likely to know the other
   side's public key, so you're not likely to be
   able to encrypt the body. Which all makes the
   need for some sort of directory service all the
   more likely, especially since these kinds of 
   considerations cannot be dealt with by the
   signaling alone... 

   Yet another reason why just plopping S/MIME in
   as a replacement for PGP didn't actually do
   much to solve real life problems. Yes, yes, I
   know... dead horse. I'll shut up now.

	       Mike
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip