Subject: RE: Comments to draft-ietf-smime-rfc2630bis-01

From: [email-masked] (Peter Gutmann)
Date: Thu, 19 Jul 2001 12:32:15 +1200 (NZST)

"Pawling, John" <[email-masked]> writes:

>Nobody (except for Peter) has stated that their implementations rejected an
>EnvelopedData based solely on the version value.

OTOH nobody (except for you) has stated that their implementations won't reject
an EnvelopedData based solely on the version value.  I'd really like to see
some comments from other implementors - Baltimore, MS, Entrust, OpenSSL,
Netscape, what do all of these implementations do?  If the vendors won't
respond, perhaps someone who has all this stuff installed for interop testing
or whatever could feed them some EnvelopedData with a weird version number (eg
42) to see what they do.

Peter.

---

From: Dr S N Henson <[email-masked]>
Date: Thu, 19 Jul 2001 02:40:08 +0100

> or whatever could feed them some EnvelopedData with a weird version number (eg

Well for current versions of OpenSSL...

It doesn't check the version value so an invalid value will be silently
permitted.

It will reject a message with an unexpected encoding such as a
RecipientInfo that isn't PKCS#7 compatible. 

It can be made more tolerant of unexpected encodings and may well end up
including CMS support anyway.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.

---

From: "Housley, Russ" <[email-masked]>
Date: Thu, 19 Jul 2001 11:54:27 -0400

I agree!

>I'd really like to see
>Netscape, what do all of these implementations do?

We have heard about three implementations (from Peter, John, and 
Jim).  Would the rest of the implementors please speak up on this issue.

Russ

---

From: Jeff Jacoby <[email-masked]>
Date: Thu, 26 Jul 2001 09:53:19 -0700

> Jim).  Would the rest of the implementors please speak up on this issue.

Sorry for the late reply.  Another data point...

The Cert-C toolkit currently will reject envelopedData messages when the
version number != 0.

Jeff
-- 
Jeff Jacoby, Sr. Programmer                
RSA Security Inc., SMDC                    [email-masked]
2755 Campus Dr., Ste. 300                  (650) 295-7569
San Mateo, CA  94403