Subject: Re: S-MIME key length

From: Dennis Glatting <[email-masked]>
Date: Wed, 27 Oct 1999 19:37:47 -0700

[email-masked] wrote:
> 
> And your signed message causes GroupWise to say, effectively, that
> "[email-masked]" is not the same person
> as the "[email-masked]" that was issued a 
> VeriSign certificate.
> 

Damn. I thought I changed my cert. Obviously I did not. I will fix
that.

> But did Communicator complain because you don't haven't added the
> Novell root certificate to your cache of trusted roots, or because your
> incoming mail processor modified the contents somehow, or was
> there some other kind of problem?
> 

I did not add a Novell root cert. However, NS says there is a "NOVELL
EMPLOYEE CA - NOVELL_INC" and another Novell cert loaded. When I read
your messages I notice your cert listed in "Other People's
Certificates." I can add that cert but I don't that that is your
point, is it?

It's possible my mail tool modified the input. I am working on my mail
environment, turning off my NeXTSTEP machines, using different mail
tools, adding TLS to secure IMAP transport -- generally having fun. 

When I click on the Invalid Signature icon associated with your
messages NS displays:

	The Certificate that was used to digitally 
	sign this message is invalid.

	The error was: The certificate issuer for 
	this server has been marked as not trusted 
	by the user. Netscape refuses to connect 
	to this server.

(I did?)

	This message included the Security 
	Certificate for BJueneman. To check the 
	Certificate or edit Certificate Trust 
	Information, press the ``View/Edit'' button. 

	This Certificate has automatically been 
	added to your list of People's Certificates 
	to make it possible for you to send secure 
	mail to this person.

What do you suggest I do?

> And BTW, Has anyone notied the irony of having these kinds of problem
> on this list? Maybe we should all start eating our own dog food, and
> actually use the stuff we're building, on this list in particular?
> 

Sure. I'm game. Though I have done much reading on PK standards and
read various other books over the years I haven't really used the
technologies, mostly due to stupid vendor implementations (my favorite
is buying a "recently released" package in May of 1999 that wasn't Y2K
compliant and required me to downgrade the NT server to a non-Y2K
version), compatibility issues, implementation issues, licensing
issues, etc. So, since I am between projects and have time on my
hands, to use your own words, I'm eating my own dog food. :)

> This is signed with a 1024 bit key, using the same root certificate, 
> which however uses a 2048 bit key.
> 

Let's resolve this issue off-line.

---

From: Lisa Repka <[email-masked]>
Date: Thu, 28 Oct 1999 15:25:56 -0700

> Certificates." I can add that cert but I don't that that is your

It may not be a problem of having the cert, just of trust.  More below.
 
> tools, adding TLS to secure IMAP transport -- generally having fun.

If the hash-matching were the problem, you would have seen a
different error than what you saw.

>         by the user. Netscape refuses to connect

Please ignore the "Netscape refuses to connect to this server."
and imagine the "for this server" was "for this user" or "for
this peer" or something slightly better like that.

(And don't blame me.  It's a long story (and this is hardly
our worst error message, either. ;-)  Short explanation: it's
a shared error message that was originally written when the
only thing you did with certificates was SSL.)

What it comes down to is that it means your problem was
one of trust, not of keysize (or modified input).
 
> What do you suggest I do?

You can do one of two things.  You can trust Bob's individual
cert directly, or you can trust his CA cert.  Both can be
accomplished via the Security Info (aka Security Advisor;
also same thing that comes up when you click on the Invalid
Signature icon in the message or when you click on the Security
button in the toolbar).  The CA cert should show up in the
Signers page; Bob's individual cert in the People page.  It sounds
like you've already located both.  Select the one you want to trust,
and then click on Edit to change the trust.

(BTW, if you're paranoid, you would check that the cert you
are trusting is really the cert you should trust.  For example
by calling Bob and asking him to tell you his certificate's
fingerprint.  Not that anybody, including those of us who
presumably "know better" *ever* do this. ;-)
 
lisa