Subject: RE: Question about security of header.

From: "Blake Ramsdell" <[email-masked]>
Date: Fri, 26 Feb 1999 02:34:23 -0800

> -----Original Message-----
> From: Taweesak Chairatanayut [mailto:[email-masked]]
> Sent: Friday, February 26, 1999 1:41 AM
> To: [email-masked]
> Subject: Question about security of header.
> 
> 	According to rfc of S/MIME V.2.0, i have a question 
> about header.
> How can i be so sure that the header of e-mail didn't be 
> changed because
> from S/MIME V.2.0 i couldn't find that header can be 
> authenticated or not
> ( i think no, right ?). Do you have any idea of header 
> authentication ?
> Please advise.

The outer RFC822 headers (Received, To, From, Subject, etc.) are not
protected by the S/MIME v2 or v3 profile.

A way to do header authentication is to wrap an entire message/rfc822 in
SignedData.

Blake
--
Blake C. Ramsdell
Worldtalk Corporation
For current info, check http://www.deming.com/users/blaker
Voice +1 425 882 8861 x103  Fax +1 425 882 8060

---

From: Taweesak Chairatanayut <[email-masked]>
Date: Fri, 26 Feb 1999 17:58:08 +0700 (GMT+0700)

> A way to do header authentication is to wrap an entire message/rfc822 in

	As i know rfc822 header don't be signed in S/MIME, so how to wrap
an entire rfc822 header in SignedData ? 

Thank a lot for your help,
Pok.

		Mr. Taweesak Chairatanayut     < E-mail:[email-masked] >
				      System Engineer             
		--------------------------------------------------------
		            Network Technology Laboratory, 
		National  Electronics  and  Computer  Technology  Center
		  Tel: (662) 642-7077 Ext. 5010,   Fax: (662) 642-7064
		--------------------------------------------------------
				    ____   ____   _  _
				   (  _ \ (    ) ( \( )
				   |  __/ | ++ | | + (
				   (__)   (____) (_)\_)