Subject: RE: cmsalg-02 RSA OID Proposal

From: "Pawling, John" <[email-masked]>
Date: Thu, 6 Sep 2001 13:03:01 -0400

All,

I agree with Blake that the RSA signature OID change should not be made if
it will cause backwards compatibility problems with legacy CMS
implementations.  So far, we have heard that this change will NOT cause
problems for the following S/MIME implementations: cryptlib (according to
Peter Gutmann), Microsoft (according to Jim Schaad) and S/MIME Freeware
Library (according to John Pawling).  So far, nobody has reported that the
change will cause backwards compatibility problems with legacy CMS
implementations.  Can anybody speak for any other implementations?  

===========================================
John Pawling, [email-masked]
Getronics Government Solutions, LLC
===========================================

---

From: [email-masked] (Terry Hayes)
Date: Tue, 11 Sep 2001 07:58:09 -0700

John,

The Netscape Communicator S/MIME (CMS) implementation expects the
rsaEncryption OID in the digest encryption algorithm field.  Since this
implementation was proven to interoperate (at one point) with the
Microsoft version, I suspect that both Netscape and Microsoft products
also generated messages with this OID value.

I suggest that we recommend that when CMS is used for email message
protection, and the CMS format is otherwise compatible with the v2
format (no new recipient formats, etc), the rsaEncryption OID should be
used.  Implementations should continue to accept the rsaEncryption value
for incoming messages.

Terry Hayes
[email-masked]