Subject: Interop Requirement for Signed Data formats

From: "Jim Schaad" <[email-masked]>
Date: Thu, 25 Mar 2004 23:15:31 -0800

In my last review of the document I found the following text in section 3.4

There are two formats for signed messages defined for S/MIME:
application/pkcs7-mime with SignedData, and multipart/signed. In
general, the multipart/signed form is preferred for sending, and
receiving agents SHOULD be able to handle both.

The problem here is that there is no interop in the signed message format as
specified by the above statement. I.E. Person one could implement
application/pkcs7-mime only and person two could implemement
multipart/signed only -- no interop.

The best change for interop purposes is to change the SHOULD to a MUST.

Comments?

Jim

---

From: "Bonatti, Chris" <[email-masked]>
Date: Fri, 26 Mar 2004 12:17:21 -0500

Agree.  It should read:

There are two formats for signed messages defined for S/MIME:
application/pkcs7-mime with SignedData, and multipart/signed.
Sending agents MUST support the multipart/signed form, and SHOULD
support the application/pkcs7-mime form. Receiving agents SHOULD
be able to handle both.

Chris

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Friday, March 26, 2004 02:16
To: [email-masked]
Subject: Interop Requirement for Signed Data formats

In my last review of the document I found the following text in
section 3.4

The problem here is that there is no interop in the signed
message format as specified by the above statement. I.E. Person
one could implement application/pkcs7-mime only and person two
could implemement multipart/signed only -- no interop.

The best change for interop purposes is to change the SHOULD to a
MUST.

Comments?

Jim

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 26 Mar 2004 11:02:18 -0800

Chris,

That still does not give interop as a receiving agent may only handle
application/pkcs7-mime. 

Making it MUST to receive both handles that problem.

jim 

-----Original Message-----
From: Bonatti, Chris [mailto:[email-masked]] 
Sent: Friday, March 26, 2004 9:17 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: Interop Requirement for Signed Data formats

Agree.  It should read:

There are two formats for signed messages defined for S/MIME:
application/pkcs7-mime with SignedData, and multipart/signed.
Sending agents MUST support the multipart/signed form, and SHOULD support
the application/pkcs7-mime form. Receiving agents SHOULD be able to handle
both.

Chris

-----Original Message-----

There are two formats for signed messages defined for S/MIME:
application/pkcs7-mime with SignedData, and multipart/signed. In general,
the multipart/signed form is preferred for sending, and receiving agents
SHOULD be able to handle both.

Comments?

Jim

---

From: Russ Housley <[email-masked]>
Date: Fri, 26 Mar 2004 14:33:54 -0500

I think that we have plenty of implementations that already handle 
both.  Please correct me if this is not the case.

If my assertion holds, then MUST for both formats seems like the best way 
forward.

Russ

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Sat, 27 Mar 2004 09:43:41 -0800

>support the application/pkcs7-mime form. Receiving agents SHOULD

Disagree with Chris, agree with Jim. The paragraph in the current 
document should read:

There are two formats for signed messages defined for S/MIME:
application/pkcs7-mime with SignedData, and multipart/signed. In
general, the multipart/signed form is preferred for sending, and
receiving agents MUST be able to handle both.

We have been over this a million times, and it is clear we can't come 
to agreement. It's history vs. correct interaction with the rest of 
email, and both have strong arguments in their favor.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Eric Norman <[email-masked]>
Date: Sat, 27 Mar 2004 18:49:35 -0600 (CST)

> receiving agents MUST be able to handle both.

Minor nit: multipart/signed also contains a PKCS7 SignedData object.

> email, and both have strong arguments in their favor.

I also agree.  Nevertheless, it might be worth a stronger warning that
multipart/signed has a greater risk of being mangled by non-compliant
mail handling software.  Many examples of this have been discovered in
mailing list software.  At least one I know of mangles the message so
badly that the plaintext is rendered unreadable by common agents.

Eric Norman

	"Congress shall make no law restricting the size of integers
	that may be multiplied together, or the number of times that
	an integer may be multiplied by itself, or the modulus by
	which an integer may be reduced".