Subject: RE: WG Last Call: cmsalg

From: "Pawling, John" <[email-masked]>
Date: Tue, 9 Oct 2001 11:13:29 -0400

All,

I vote for option 3: "Use PKIX for everything except for v1 attribute
certificates; define v1 attribute certificates in the rfc2630bis appendix." 

I agree with Jim Schaad that the S/MIME specs should reference the ASN.1
modules in the PKIX documents instead of the ITU-T documents.  The PKIX
documents are freely available to all, but the ITU-T documents are not. 

To my knowledge, RFC 2630 is the only IETF spec that uses the v1 attribute
certificate syntax, so I agree with Russ Housley that the v1 attribute
certificate syntax should be included in a rfc2630bis appendix.

The S/MIME Freeware Library can ASN.1 encode and decode signedData and
envelopedData content types that include v1 attribute certificates.  I don't
know of any operational use of v1 attribute certificates in signedData and
envelopedData content types.    

===========================================
John Pawling, [email-masked]
Getronics Government Solutions, LLC
===========================================

---

From: "Pawling, John" <[email-masked]>
Date: Mon, 15 Oct 2001 15:50:23 -0400

Magnus,

I still agree with Jim Schaad's original point that the S/MIME specs should
import the certificate, CRL and attribute certificate ASN.1 syntaxes (and
components thereof) from the ASN.1 modules in the PKIX specs since the PKIX
working group is the authoritative source for the IETF regarding the
specification of those objects.

It would be great news if all of the ITU-T Recommendations were freely
available.  However, the  ITU-T web page
<http://www.itu.int/ITU-T/publications/index.html> states:

"ITU-T Recommendations in Force

These are available for purchase and published in different forms -
individual paper fascicles, individual electronic files, entire collection
on CD-ROM, through yearly on-line subscription to all Recommendations in
force."

Also, in a message sent to the PKIX mail list in May 2001, Hoyt Kesterson
stated: "ITU is allowing any three recommendations to be downloaded at no
cost from their server."  I have never seen a statement that all of the
ITU-T Recommendations were freely available.

-----Original Message-----
From: Magnus Nystrom [mailto:[email-masked]]
Sent: Friday, October 12, 2001 5:23 AM
To: [email-masked]
Subject: RE: WG Last Call: cmsalg

Actually, it turns out that they indeed are freely available:

http://www.itu.int/ITU-T/asn1/database/itu-t/x/index.html

Many Thanks to Hoyt Kesterson for informing me about this. Hoyt
mentioned to me that the database perhaps is not complete yet; a quick
look however indicates that all needed v3 modules are in place.

So, perhaps S/MIME could reference these modules after all...

BR,
-- Magnus