Subject: [media-types] review requested: draft-turner-application-cms-media-type

From: Sean Turner <[email-masked]>
Date: Mon, 03 Jun 2013 13:13:20 -0400

I'd like to request an expert review for the application/cms media type 
registration found in:
http://tools.ietf.org/html/draft-turner-application-cms-media-type

Thanks,

spt

---

From: Sean Turner <[email-masked]>
Date: Mon, 10 Jun 2013 10:11:43 -0400

In case I'm just supposed to sending the template:

spt

------

Type name: application

Subtype name: cms

Required parameters: None.

Optional parameters:

   encapsulatedContent=y; where y is one or more CMS ECT
   (Encapsulating Content Types); multiple values are encapsulated in
   quotes and separated by a folding-whitespace comma folding-
   whitespace.  ECT values are based on content types found in
   [RFC3274], [RFC4073], [RFC5083], [RFC5652], and [RFC6032].  This
   list can later be extended see Section 3.
              authData
              compressedData
              contentCollection
              contentInfo
              contentWithAttrs
              authEnvelopedData
              encryptedKeyPkg
              digestData
              encryptedData
              envelopedData
              signedData

   innerContent=x; where x is one or more CMS ICT (Inner Content
   Types); multiple values encapsulated in quotes and are separated by
   a folding-whitespace comma folding-whitespace.  ICT values are
   based on content types found in [RFC4108], [RFC5914], [RFC5958],
   [RFC6031], and [ID.housley-keypackage-receipt-n-error].  This list
    can later be extended see Section 3.
              firmwarePackage
              firmwareLoadReceipt
              firmwareLoadError
              aKeyPackage
              sKeyPackage
              trustAnchorList
              keyPackageReceipt
              keyPackageError

   id-data [RFC5652] MUST NOT be used if it is the only inner content
   listed and the data is MIME content;  when id-data is used to
   encapsulate MIME, the media type application/pkcs7-mime media type
   defined in [RFC5751] SHOULD be used.

   The optional parameters are case-sensitive.

Encoding considerations:

   Binary.

   [RFC5652] requires that the outer most encapsulation be
   ContentInfo.

Security considerations:

   See [RFC3370], [RFC5652], [RFC5753], and [RFC5754] for id-
   signedData, id-envelopedData, id-digestData, id-encryptedData, id-
   ct-authData; see [RFC5958], [RFC5959], and [RFC6162] for id-ct-KP-
   aKeyPackage; see [RFC6031] and [RFC6160] for id-ct-KP- sKeyPackage;
   see [RFC6032], [RFC6033], and [RFC6161] for id-ct-KP-
   encryptedKeyPkg; see [RFC5914] for id-ct-trustAnchorList; see
   [RFC3274] for id-compressedData; see [RFC5083] and [RFC5084] for
   id-ct-authEnvelopedData; see [RFC4073] for id-ct-contentCollection
   and id-ct-contentWithAttrs; see [RFC4108] for id-ct-
   firmwarePackage, id-ct-firmwareLoadReceipt, id-ct-
   firmwareLoadError; see [ID.housley-keypackage-receipt-n-error] for
   id-ct-KP-keyPackageReceipt and id-ct-KP-keyPackageError.

Interoperability considerations:

   See [RFC3274], [RFC4073], [RFC4108], [RFC5083], [RFC5652],
   [RFC5914], [RFC5958], [RFC6031], [RFC6032], and [ID.housley-
   keypackage-receipt-n-error].

   In all cases, CMS content types are encapsulated within ContentInfo
   structures [RFC5652]; that is the outer most enveloping structure
   is ContentInfo.

   When processing a SignedData around any of the inner content type
   the [RFC5652] validation rules MUST be used.  The PKCS #7 [RFC2315]
   validation rules MUST NOT be used.

Published specification: This specification.

Applications which use this media type:

   Applications that support CMS (Cryptographic Message Syntax)
   content types.

Additional information:

   Magic number(s): None
   File extension(s): .cms
   Macintosh File Type Code(s):

Person & email address to contact for further information:

   Sean Turner <[email-masked]>

Restrictions on usage: none

Author: Sean Turner <[email-masked]>

Intended usage: COMMON

Change controller: The IESG <[email-masked]>

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Thu, 13 Jun 2013 12:34:48 +0200

>   list can later be extended see Section 3.

I think the first "ECT" should be "ECTs"; I can't parse the part after
the semicolon. There should probably be a comma before "see". Same for
the next parameter.

>   id-ct-KP-keyPackageReceipt and id-ct-KP-keyPackageError.

Editorially the above is quite horrible, maybe a table to map the values
to the RFCs would be better. Also, there should be some prose to set the
context here (why would one "see" all the referenced documents, and why
are there no security considerations for the type right here, beyond the
suggestion to look elsewhere).
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Sean Turner <[email-masked]>
Date: Thu, 13 Jun 2013 09:13:30 -0400

> the semicolon. There should probably be a comma before "see". Same for

Fixed.

> suggestion to look elsewhere).

These are a list of all the RFCs where these content types are defined 
plus the documents that define algorithms that can be used to protect 
the content types.  There was one additional consideration in the draft 
that didn't end up in the template so how about:

Security Considerations:

The following security considerations apply:

RFC       | CMS Protecting Content Type and Algorithms
----------+-------------------------------------------------
[RFC3370] | id-signedData, id-envelopedData, id-digestedData,
[RFC5652] | id-encryptedData, and id-ct-authData
[RFC5753] |
[RFC5754] |
----------+-------------------------------------------------
[RFC5958] | id-ct-KP-aKeyPackage
[RFC5959] |
[RFC6162] |
----------+-------------------------------------------------
[RFC6031] | id-ct-KP-sKeyPackage
[RFC6160] |
----------+-------------------------------------------------
[RFC6032] | id-ct-KP-encryptedKeyPkg
[RFC6033] |
[RFC6161] |
----------+-------------------------------------------------
[RFC5914] | id-ct-trustAnchorList
----------+-------------------------------------------------
[RFC3274] | id-compressedData
----------+-------------------------------------------------
[RFC5083] | id-ct-authEnvelopedData
[RFC5084] |
----------+-------------------------------------------------
[RFC4073] | id-ct-contentCollection and
           | id-ct-contentWithAttrs
----------+-------------------------------------------------
[RFC4108] | id-ct-firmwarePackage, id-ct-firmwareLoadReceipt,
           | and id-ct-firmwareLoadError
----------+-------------------------------------------------
[RFCTBD]  | id-ct-KP-keyPackageReceipt and
           | id-ct-KP-keyPackageError
----------+-------------------------------------------------

In some circumstances, significant information can be leaked by 
disclosing what the innermost ASN.1 structure is.  In these cases it is 
acceptable to disclose the wrappers without disclosing the inner content 
type.

---

From: Sean Turner <[email-masked]>
Date: Thu, 13 Jun 2013 09:21:55 -0400

Sorry hit send to fast.

>> the semicolon. There should probably be a comma before "see". Same for

The part after the semicolon is supposed to indicate how multiple values 
are carried.  What I'd like is:

value, value

My understanding is that a , needs to go in between quotes hence:

multiple values are encapsulated in quotes and separated by a 
folding-whitespace comma folding-whitespace.

so if we had authData and compressedData it would be:

ect="authData, compressedData"

spt

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 13 Jun 2013 15:04:19 +0100

Hi Sean,

>   File extension(s): .cms
I would pick a different extension (possible a 4 letter one), unless 
.cms is already in use for this media type.

http://filext.com/file-extension/CMS shows something else.

---

From: Sean Turner <[email-masked]>
Date: Tue, 18 Jun 2013 07:14:13 +0900

> http://filext.com/file-extension/CMS shows something else.

How about cmsc for cms content?

spt

---

From: Sean Turner <[email-masked]>
Date: Tue, 18 Jun 2013 14:04:58 +0900

> http://filext.com/file-extension/CMS shows something else.

Updated file can be found here:
http://datatracker.ietf.org/doc/draft-turner-application-cms-media-type

spt

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 18 Jun 2013 17:10:13 +0100

> http://datatracker.ietf.org/doc/draft-turner-application-cms-media-type

This looks Ok to me.