Subject: Re: Algorithm Dependancy Issues

From: "Enzo Michelangeli" <[email-masked]>
Date: Fri, 6 Nov 1998 19:38:26 +0800

-----Original Message-----
From: Darren Harter <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Friday, November 06, 1998 7:00 PM
Subject: CMS: Algorithm Dependancy Issues

> I'd like to raise an issue that is giving me some problems.
> Currently, the CMS spec describes a number of algorithms for both
> authentication and confidentiality, mandating some of them and
> leaving others optional.
>
> I believe the right algorithms etc are mandated for S/MIME over the
> Internet.
> But, as CMS is intended for use outside of S/MIME as a 'protocol
> bucket' by other applications that may not wish (or may no be able)
> to support the mandated algorithm set, surely the best place to
> specify and mandate algorithms is in the MSG spec.

Wouldn't that endanger interoperability between CMS-compliant agents sitting
on the two sides of the fence, and exchanging mail through a gateway?

Enzo

---

From: "Darren Harter" <[email-masked]>
Date: Mon, 09 Nov 1998 15:42:18 +0000

Enzo,

IHO, the aim of the S/MIME WG is to ensure interoperability of S/MIME.  I view S/MIME as a profile (the MSG spec) of the CMS/ESS and other specs.  So to be S/MIME compliant you must meet the mandatory elements of the MSG spec and this implies compliancy with certain aspects of the CMS spec, but not all of it.

I believe that vendors should be able to remain CMS compliant without being S/MIME compliant or dependant of S/MIME's algorithms suite.

IMHO, protocol and procedural compliancy should be treated differently from algorithm compliancy.  I would like to see CMS be algorithm independant.

For this reason, IMO I believe your question should have been:

Wouldn't that endanger interoperability between S/MIME-compliant agents sitting on the two sides of the fence, and exchanging mail through a gateway?

And the answer would be no, as the S/MIME spec ensures interoperability.

Regards,

Darren

-------------------------------------------------------------
Darren Harter BSc Hons MBCS CEng
CASM Technical Architect
CASM Programme Office
CESG
Work: [email-masked]
Home: [email-masked]

>>> "Enzo Michelangeli" <[email-masked]> 11/06/98 11:38am >>>

Enzo

---

From: "Enzo Michelangeli" <[email-masked]>
Date: Tue, 10 Nov 1998 10:32:52 +0800

-----Original Message-----
From: Darren Harter <[email-masked]>
To: [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Date: Tuesday, November 10, 1998 2:36 AM
Subject: Re: Algorithm Dependancy Issues

>Enzo,
>
>IHO, the aim of the S/MIME WG is to ensure interoperability of S/MIME.  I
view S/MIME as a profile (the MSG spec) of the CMS/ESS and other specs.  So
to be S/MIME compliant you must meet the mandatory elements of the MSG spec
and this implies compliancy with certain aspects of the CMS spec, but not
all of it.
>
>I believe that vendors should be able to remain CMS compliant without being
S/MIME compliant or dependant of S/MIME's algorithms suite.
>
>IMHO, protocol and procedural compliancy should be treated differently from
algorithm compliancy.  I would like to see CMS be algorithm independant.
>Wouldn't that endanger interoperability between S/MIME-compliant agents
sitting on the two sides of the fence, and exchanging mail through a
gateway?
>And the answer would be no, as the S/MIME spec ensures interoperability.

But there are gateways that bridge between Internet (RFC822+MIME) and
non-Internet mail transports. Why should those two worlds risk
non-interoperability, even when the agents on both sides comply with CMS?

The S/MIME working group might choose not to address this issue, but then
someone else (a CMS working group?) should.

Enzo