Subject: [Simple] IMDN Issue #1: Security of IMDN

From: "Burger, Eric" <[email-masked]>
Date: Mon, 5 Dec 2005 13:31:00 -0500

Proposal is that if the body of the message was encrypted or signed, the
IMDN MUST be encrypted or signed, otherwise it MAY be plain text.

Any dissent?

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Cullen Jennings <[email-masked]>
Date: Mon, 12 Dec 2005 10:09:06 -0800

> IMDN MUST be encrypted or signed, otherwise it MAY be plain text.

If the IMDN was only signed, but the original message was encrypted, would
the IMDN reveal anything that was not in the unencrypted portion of the
message?

This proposal does seem a little weird - what happens if you can't sign the
IMDN?

Perhaps we might want something like the following 3 rules

Always sign the IMDN if you have a cert.

If the message was singed and encrypted, MUST encrypt repose.

If the message was encrypted, MUST sign IMDN.