Subject: Forwarding of signedData objects

From: Core Scott-P18750 <[email-masked]>
Date: Mon, 23 Aug 1999 14:20:11 -0700

All

I am curious how forwarding of signedData Objects is being implemented. It
would be desirable when forwarding a triple wrapped signedData object to
retain the original signature value, however if a signed receipt were
requested in this object it would propagate to the forwarded message also.
That would mean that a signed receipt would be generated from all of the
recipients of the forwarded message whether or not that was the desire of
the person forwarding the message. 

Can anyone shed some light on this or is there something wrong with my
interpretation of the signed receipt attribute in ESS? 

thanks

scott core
motorola

---

From: "Pawling, John" <[email-masked]>
Date: Tue, 24 Aug 1999 18:31:08 -0400

Scott,

If the signer of the forwarded (i.e. inner) signedData includes a
receiptRequest attribute that includes the receiptsFrom allOrFirstTier set
to allReceipts, then every entity that verifies the signature of the
signerInfo containing the receiptRequest is supposed to return a signed
receipt (unless superseded by a Mail List Receipt Policy as noted below).
Note that the signer may have designated that only specified recipients
(ReceiptsFrom receiptList CHOICE) or first-tier recipients (receiptsFrom
allOrFirstTier set to firstTierRecipients) should return a signed receipt.  

As stated in RFC 2634, Section 2.3, the presence of an mlExpansionHistory
attribute in the outermost signedData can supersede the receiptRequest in
the inner signedData.  If the last mlData element in the mlExpanisonHistory
attribute includes a mlReceiptPolicy value of NONE, "then the receipt policy
of the Mail List supersedes the originator's request for a signed receipt
and a signed receipt MUST NOT be created."

============================================
John Pawling, Director - Systems Engineering
J.G. Van Dyke & Associates, Inc.,
a Wang Government Services Company
[email-masked]
============================================