Subject: Signing on behalf of somebody else

From: Nagaraj Mandya <[email-masked]>
Date: Wed, 18 Jul 2001 05:13:11 +0100 (BST)

Hi,
   Is it possible for a mail being sent by one person
be signed by a different person and still be treated
as a valid signature?

   My problem is like this. Any mail that a client
receives signed by a particular person's certificate
should be considered valid by the client irrespective
of who the actual sender is.

   Thanks.
--
Regards,
Nagaraj

____________________________________________________________
Do You Yahoo!?
For regular News updates go to http://in.news.yahoo.com

---

From: "Rahul Banerjee" <[email-masked]>
Date: Wed, 18 Jul 2001 12:31:30 +0530

IMHO, asking for this feature would probably defy the very reason of this
security provision.

Regards.

Rahul

---

From: "William Ottaway" <[email-masked]>
Date: Wed, 18 Jul 2001 09:10:22 +0100

Hi Nagaraj,

Have you looked at the DOMSEC draft?
http://www.ietf.org/internet-drafts/draft-ietf-smime-domsec-08.txt

It allows for others to sign a message. It also specifies a domain/company
signature. A valid company signature means the message can be accepted
irrespective of whether there is an originator signature or not.

Bill.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Nagaraj Mandya
> Sent: 18 July 2001 05:13
> To: [email-masked]

---

From: "Rahul Banerjee" <[email-masked]>
Date: Wed, 18 Jul 2001 15:01:35 +0530

Hi,

A Company-specific signature is definitely acceptable. I guess, Nagraj's
question related to signing on behalf of another individual  ---- and, this
had security implications.

Regards.

Rahul

---

From: "William Ottaway" <[email-masked]>
Date: Wed, 18 Jul 2001 10:40:55 +0100

Rahul,

DOMSEC also allows for another person to sign a message, as in the case when
you have a release authority. This could be an individual who verifies that
the message can be released.

Bill.

> From: Rahul Banerjee [mailto:[email-masked]]
> Sent: 18 July 2001 10:32
> To: William Ottaway; Nagaraj Mandya; [email-masked]
> Subject: Re: Signing on behalf of somebody else
>
>
> Hi,
>

---

From: "David P. Kemp" <[email-masked]>
Date: Thu, 19 Jul 2001 16:34:45 -0400

Leaving aside DOMSEC, the subject is confusing - a person who
possesses a private key cannot sign "on behalf of" someone else
unless the private key belongs to (and the certificate was
issued to) someone else.  Perhaps the subject was intended to
be "Sending on behalf of somebody else"?

In S/MIME v3 there is no connection between "sent by" (the From:
field in the unsigned RFC-822 message header) and "signed by"
(the name(s) contained in the certificate that validates the
signature).  V2 required certificates to contain an rfc822
address and for that address to match an unsigned header field;
those limitations were removed in v3.  The person named in the
certificate is the one who's signature will be validated;
that person can send email from home or from work, and can
switch jobs or switch ISPs without invalidating message
signatures.  Mail servers can rewrite addresses without
invalidating message signatures.

I'm not sure how a message signed by person A could be "sent"
(as opposed to being forwarded or otherwise included as an
attachment) by person B, but if an application were created
that allowed A to sign a message and B to push the button that
sends it to a mail server, that application would not violate
the intent of S/MIME v3.  It is the signer's signature, not the
sender's From: address, that is being validated.

Dave

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 20 Jul 2001 08:08:21 +0200

David,

>those limitations were removed in v3. 

 Does this mean that you don't actually need any rfc822 address
at all in the certificate.  I.e. the s.c. "e-mail certificates" is in
v3 essentially a dead item?

Personally I think this is great for the reasons you mentioned!

Anders