Subject: [lamps] header protection: multipart/signed wrapped message

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 26 May 2021 21:30:45 -0400

Hi LAMPS folks--

I observe that the S/MIME sample messages produced for
draft-ietf-lamps-header-protection contain a few whose signatures do not
validate for my tests.  I need help from the WG (in the form of
evaluation or generating sample messages) to diagnose the problem.

Please help!

In particular, the messages that fail signature validation have both of
these two properties:

 - they are multipart/signed
 - they use the Wrapped Message header protection scheme

multipart/signed messages without Wrapped Message header protection
(either Injected Headers or no header protection) do *not* fail
validation, and one-part signed (SMIME signedData) or encrypted+signed
messages with Wrapped Message header protection also all validate just
fine.

Either I'm doing something wrong in generating those messages, or all
the validation libraries i've tested are making the same mistake.  I'm
not sure which.

How you can help:

Make a multipart/signed message with Wrapped Message header protection
----------------------------------------------------------------------

Does someone have a MUA that generates the Wrapped Message header
protection scheme and can send multipart/signed messages?  If so, could
you try generating such a multipart/signed message (not encrypted!)
using Alice's Signing Key and Certificate from
draft-ietf-lamps-samples-04, with the WrappedMessage header protection
scheme and forward the message (as an attachment, maybe) to this list
(or just reply to me privately)?

Alice's signing secret key and verification certificate are here:

   https://www.ietf.org/archive/id/draft-ietf-lamps-samples-04.html#name-alices-signing-private-key-
   https://www.ietf.org/archive/id/draft-ietf-lamps-samples-04.html#name-alices-signature-verificati

Or you can load them both (plus Alice's decryption key and encryption
certificate) from a PKCS#12 file with the password "alice" which can be
un-base64'ed from:

    https://www.ietf.org/archive/id/draft-ietf-lamps-samples-04.html#name-pkcs12-object-for-alice

Examine multipart/signed test vectors that are Wrapped Messages
---------------------------------------------------------------

Alternately, if you are up for taking a look at the two messages that
fail validation for me, you can fetch them here:

   https://header-protection.cmrg.net/header-protection.maildir/new/smime-multipart-wrapped.eml
   https://header-protection.cmrg.net/header-protection.maildir/new/smime-multipart-complex-wrapped.eml

Or of course you can copy them out of the draft at:

   https://www.ietf.org/archive/id/draft-ietf-lamps-header-protection-04.html#name-s-mime-signed-only-multipart-
   https://www.ietf.org/archive/id/draft-ietf-lamps-header-protection-04.html#name-s-mime-signed-only-multipart-si

Thanks for looking into this,

       --dkg

---

From: Russ Housley <[email-masked]>
Date: Thu, 27 May 2021 15:53:04 -0400

DKG:

I am also unable to verify the signature.  They error seems to indicate that the signature is wrong, not that a problem with the trust anchor.  I'll send a screen shop privately.

Russ

> On May 26, 2021, at 9:30 PM, Daniel Kahn Gillmor <[email-masked]> wrote:
> 
> Signed PGP part
> Hi LAMPS folks--
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 27 May 2021 21:00:03 -0400

On Thu 2021-05-27 15:53:04 -0400, Russ Housley wrote:

> I am also unable to verify the signature.  They error seems to
> indicate that the signature is wrong, not that a problem with the
> trust anchor.  I'll send a screen shop privately.

Thanks for the confirmation that it's not just the tooling I happen to
have looked at.

I did a bit more digging and discovered a piece of the python e-mail
message generation tooling didn't work the way i expected it to
regarding CRLF vs LF line endings.  sigh, it's like the gift from the
1980s that just keeps on giving.

I worked around it [0] and re-generated the multipart/signed wrapped
messages, and they now validate correctly in the tools i've tested.
I've just uploaded draft -05 with the fix, and i've updated the
published versions of the test vectors (IMAP, zipped maildir, mbox, etc)
at https://header-protection.cmrg.net/ as well.

The screenshots of balsa, thunderbird, and evolution all now show valid
signatures on the multipart/signed wrapped messages too.

The changes in the draft are extremely minimal [1].  i hope folks will
step up with more testing and review.

        --dkg

[0] https://gitlab.com/dkg/lamps-header-protection/-/commit/aaf5350bb5b170a14a4d85c18344258cb63c2fd4
[1] https://www.ietf.org/rfcdiff?url1=draft-ietf-lamps-header-protection-04&url2=draft-ietf-lamps-header-protection-05