Subject: CMS: Algorithm Dependancy Issues

From: "Darren Harter" <[email-masked]>
Date: Fri, 06 Nov 1998 09:49:11 +0000

I'd like to raise an issue that is giving me some problems.  Currently, the CMS spec describes a number of algorithms for both authentication and confidentiality, mandating some of them and leaving others optional.

I believe the right algorithms etc are mandated for S/MIME over the Internet.  But, as CMS is intended for use outside of S/MIME as a 'protocol bucket' by other applications that may not wish (or may no be able) to support the mandated algorithm set, surely the best place to specify and mandate algorithms is in the MSG spec.  

That way vendors will be able to claim conformance to CMS without having to implement the mandatory algorithm set.  It will make no difference to those claiming conformance to S/MIME.  To me the latter means conforming to the profile of CMS/ESS etc. that the MSG spec lays down.

Likewise, it concerns me that the CMS spec is reliant on the X942 spec.  Again, I believe this should be referred to by the MSG spec not CMS.

-------------------------------------------------------------
Darren Harter BSc Hons MBCS CEng
CASM Technical Architect
CASM Programme Office
CESG
Work: [email-masked]
Home: [email-masked]

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Fri, 06 Nov 1998 11:18:45 -0800

Without a minimum set of algorithms, you cannot have two protocols that
both use CMS talk to each other. This was a strongly-desired feature of
CMS, since the IETF strives to have its protocols work together, or at
least not clash in an ugly fashion.

The required set of algorithms is tiny. It assures us that if some protocol
developer comes along tomorrow and says, "hmmmm, CMS looks good" that they
don't pick some odd encryption algorithm that will never interact with
S/MIME or other CMS-using protocols.

--Paul Hoffman, Director
--Internet Mail Consortium