Subject: SMIME Capabilities in X.509 Certificates

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 15 Jun 2004 03:23:44 +0100

Stefan Santesson
Program Manager, Windows Security
Principal Consultant, Microsoft Denmark
Please find attached a proposed updated charter which would incorporate
the task to define means to carry SMIME Capabilities in X.509
Certificates.

This revised charter has been reviewed and approved by Russ Hously on
the condition that this WG accept to take on this task.

We had a discussion on this issue in PKIX which some of you may have
noticed where a majority concluded that this was a good thing to do but
the post discussion, especially with Russ, also concluded that SMIME is
probably the best place to do it and not PKIX.

The background of this work item is the need to establish knowledge
about opponents SMIME Capabilities, even before a first message
exchange. We will never escape the fact that a sender of an encrypted
mail some times will have to guess the recipients cryptographic
capabilities. In other situations the sender may have access to multiple
sources of data with conflicting information so the sender should always
be prepared to use the most recent and reliable source of information.
But in absence of any information at all, the sender have to fallback to
default configuration settings.

It would thus improve the situation if CAs, especially enterprise CAs,
that knows or even have the capability to dictate the capabilities of
users, could include the PKCS#9 SMIMECapabilities attribute in
certificates.

One such solution is in practical use since quite some time now.
Both Microsoft CAs and e-mail clients have since long the capabilities
to include and extract users SMIME Capabilities in certificates using
this PKCS#9 attribute as a certificate extension.

This work item should hopefully therefore be a rather simple to conclude
since the PKCS#9 attribute is already defined and used in SMIME for this
purpose, and one way of using this attribute in certificates is already
in widespread use.

I will, given that the WG accepts this work item, volunteer to write the
first draft.

/Stefan Santesson

---

From: "Blake Ramsdell" <[email-masked]>
Date: Thu, 17 Jun 2004 21:23:53 -0700

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stefan Santesson
> Sent: Monday, June 14, 2004 7:24 PM
> To: smime mailing list
> Cc: smime chair; smime chair
> Subject: SMIME Capabilities in X.509 Certificates
> 

OK, so as far as I can tell, what's being asked is as follows:

* Modification of the ietf-smime charter to allow for the discussion of
a profile of the SMIME Capabilities extension to be included in X.509
certificates

* The actual discussion of such a thing on the ietf-smime mailing list

* Creation of one or more drafts to summarize the consensus, ultimately
resulting in one or more RFCs in the S/MIME working group

This all sounds like stuff we can do. If there's something I'm missing,
someone point it out, otherwise it seems reasonable to undertake this
work in the working group.

One other thing we should probably discuss is whether or not this effort
has any impact on S/MIME message processing, and if we need to address
that.

Blake