Subject: S/MIME 3 Clients - Are there such?

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 10 Sep 2001 13:32:48 +0200

In S/MIME V3 e-mail address is optional.
That's good.

But, are there any mail-clients that supports certs w.o. mail-addresses?
Microsoft's does not AFAIK.  At least not on sending.  

Regards
Anders Rundgren
X-OBI

---

From: Michael Ströder <[email-masked]>
Date: Mon, 10 Sep 2001 15:47:30 +0200

> In S/MIME V3 e-mail address is optional.

(Sigh!)

> That's good.

Nope.

> But, are there any mail-clients that supports certs w.o. mail-addresses?

Yes. I saw one made by SSE. But it will be a pain in the ass to
teach Joe Average user to assign the right certificates to the right
person.

Ciao, Michael.

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 10 Sep 2001 16:34:48 +0200

Michael,
Thanx for the answer.

I guess this option was introduced to be able to use your "electronic ED-Card"
from anywhere and make the mail-system to be regarded as "transport"
in the same way as SSL.

The same could be valid for mobile-phones and PKI as well.
I.e. the phone-number is just an identified but anyway "bearer".

Or for e-business where the org-cert contains a DUNS-number which
is more important than mail-address.  Lets say a portal with buyers
using the same domain.

But it does get a little bit weird.

Anders

----- Original Message -----
From: "Michael Ströder" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, September 10, 2001 15:47
Subject: Re: S/MIME 3 Clients - Are there such?

(Sigh!)

Nope.

Ciao, Michael.

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 10 Sep 2001 08:39:44 -0700

Anders,

It is possible to configure Microsoft Outlook to allow for not having
the E-Mail address in a certificate.  However due to the "problems"
involved in getting associations correct, the decision was mad that this
should not be default behavior.

jim

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Anders Rundgren
> Sent: Monday, September 10, 2001 7:35 AM
> To: [email-masked]
> Cc: [email-masked]

---

From: Michael Ströder <[email-masked]>
Date: Mon, 10 Sep 2001 21:04:03 +0200

> from anywhere and make the mail-system to be regarded as "transport"

Note that you have to put the server's name into the CN attribute of
the SSL server's certificate subject DN. Maybe it's different in
current IETF-TLS profile draft. I did not follow that closely.

> is more important than mail-address.  Lets say a portal with buyers

I already know all these arguments. But Joe Average user will be
unable to verify that this specific DUNS number can be assigned to a
certain e-mail address. Normal users *might* be able to perform a
complete string equality match. But not much more. People do not
understand name spaces. Period. I did enough 1st level support
especially with S/MIMEv2...

I hope that not many CAs are going to issue e-mail certificates
without e-mail address. In this particular case I regard it as an
advantage that most CAs will decide to be backwards-compatible to
S/MIMEv2.

> But it does get a little bit weird.

Snip the word "little" and you're getting closer to it...

Ciao, Michael.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 11 Sep 2001 14:17:05 +0200

Michael,
It is possible that all this will be redudant as e-mail for business messages
(my line of work) is a declining activity.  The encryption scheme in e-mail is a
killer (in the negative aspect) compared to https (SSL/TLS).

I did try to force my Outlook to accept an "e-mail-less" cert but
I did not succeed.  Anyone who knows the trick?

Anders

----- Original Message -----
From: "Michael Ströder" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, September 10, 2001 21:04
Subject: Re: S/MIME 3 Clients - Are there such?

Ciao, Michael.