Subject: Re: SMIME and disclaimers

From: [email-masked] (Peter Gutmann)
Date: Thu, 20 Feb 2003 17:30:41 +1300

[email-masked] writes:

>Discounting whether disclaimers carry any worthwhile legal weight,
>technically is it feasible to add a disclaimer to outgoing SMIME messages at
>the outgoing server without breaking the signature ?

Stick 'em in the unsigned attributes.  Benefits:

 - Doesn't break the signature.
 - It's much easier for users to ignore them there than tacked onto the end
   of the message.

Actually, another option would be:

 - Put them in the certPolicies.  God knows there's everything else in there
   already, so one more piece of cruft won't hurt.

Peter :-).

---

From: "Tom Gindin" <[email-masked]>
Date: Thu, 20 Feb 2003 12:50:47 -0500

Peter:

      Leaving a disclaimer outside the signature base removes most of the
point of having one.  It needs to be in the footer or in a signed
attribute.  Having it in the certificate is fine if you always want the
disclaimer - see the many NR discussions on this list, as you know.

Tom Gindin
I/T Architect - Security
IBM Business Consulting Services - Public Sector
Phone (301) 803-3460

[email-masked] (Peter Gutmann)@mail.imc.org on 02/19/2003
11:30:41 PM

Sent by:    [email-masked]

To:    [email-masked], [email-masked]
cc:
Subject:    Re: SMIME and disclaimers

 - Put them in the certPolicies.  God knows there's everything else in
there
   already, so one more piece of cruft won't hurt.

Peter :-).