Subject: RE: Are certificates _required_ by the sender?

From: "Craig McGregor" <[email-masked]>
Date: Thu, 9 May 2002 09:41:14 +1200

Hi Ben,

Although I have not tested this theory, I suspect it is so that it can
encrypt the message both for the recipient and sender. Otherwise the
sender could not read their message from their sent items folder without
access to the recipients private key - which of course is a no-no!

Nothing in the S/MIME RFC's says you _have_ to have one. You should be
able to happily encrypt but not sign e-mail without one. Practicalities
mean for certain functionality in clients it may be necessary to have
your own certificate.

--
Craig McGregor		
Security Specialist	
IT Systems 			http://e.govt.nz/see/mail
The Treasury		http://www.treasury.govt.nz

-----Original Message-----
From: Ben Littauer [mailto:[email-masked]]
Sent: Thursday, 9 May 2002 4:08 a.m.
To: [email-masked]
Subject: RE: Are certificates _required_ by the sender?

Interesting you should ask this right now.  I don't believe that there
is
any S/MIME requirement that says that the sender needs a cert.  That
said,
however, MS Outlook DOES require that you have a cert before it will let
you
encrypt a message on someone else's cert that you've received.  Does
anyone
know why this is?

-ben-

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Terje Tollisen
Sent: Wednesday, May 08, 2002 5:26
To: [email-masked]
Subject: Are certificates _required_ by the sender?

Is the sender of an email required to have a certificate, or is it
sufficient for the sender to have a copy of the certificate of the
recipient? I am thinking of an automated system, where one party will
always
be the sender, and never receive emails. In addition, no signatures are
required. Thus nobody will ever actually need the public key for the
automated system. However, I'm uncertain if the sender can send S/MIME
messages without having a certificate of it's own.

Thanks for your time
-Terry Tollisen

--
_______________________________________________
Sign-up for your own FREE Personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

---

From: "Housley, Russ" <[email-masked]>
Date: Wed, 15 May 2002 10:18:30 -0400

Ben & Craig:

This is appropriate behavior.  RFC 2633, in section 3.3, says:

    ...  In addition to encrypting a copy of
    the content-encryption key for each recipient, a copy of the content
    encryption key SHOULD be encrypted for the originator and included in
    the envelopedData (see CMS Section 6).

Russ