Subject: RE: [Sip] S/MIME certificates question

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 11 Sep 2002 15:47:38 -0400

Our intention was not to rule out things like content indirection, although
at the time we didn't understand SIP-based content indirection well enough
to make special allowances for it. The MUST is present, as Mark conjectures,
in order to ensure that the cert will be available to the destination, not
to dictate any particular manner in which it must be made available. I think
the use of content indirection meets the spirit, if not exactly the letter,
of the passage quoted below.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Mark Watson [mailto:[email-masked]]
> Sent: Wednesday, September 11, 2002 6:49 AM
> To: [email-masked]'
> Subject: [Sip] S/MIME certificates question
> 
> 
> All,
> 
> In RFC3261 23.2 it states:
> 
> "Whenever the CMS SignedData message is used in S/MIME for 
> SIP, it MUST
> contain the certificate bearing the public key necessary to verify the
> signature."
> 
> I assume that "it" refers to the CMS SignedData message.
> 
> An alternative would presumably be for the certificate to be 
> contained in a
> separate MIME part of type application/pks7-mime with
> smime-type="certs-only". This would have the advantage that 
> the certificate,
> which does not change often, and which I understand can be 
> fairly large,
> could make use of content indirection.
> 
> If the certificate is required to be embedded in the same 
> SignedData object
> as the signature itself, then I guess this would not be possible.
> 
> So, is inclusion of the certificate as a separate body part, 
> prohibited by
> the SIP specification ?
> 
> Regards...Mark
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Wed, 11 Sep 2002 15:55:35 -0700 (PDT)

> of the passage quoted below.

   If there are other ways to obtain the certificate -- 
   assuming that there's a certificate at all -- then
   forcing it to be sent through SIP is quite wasteful.
   In fact, the device itself may not even know what 
   certificates are associated with its public key.

   And this, of course, doesn't even begin to address
   the larger issue of not knowing what certs roots
   and namespaces are in common between the two UA's.
   My browser, for example, knows about the roots of
   about 3 dozen CA's; there's no guarantee that the
   cert under the root the UAC chooses will have any
   relevance to the UAS; it's pretty much the same
   shot in the dark as not sending any cert at
   all. As in, the likelihood of interoperablity
   on almost any scale beyond "lab" is extremely
   low as currently specified.

	  Mike