Subject: DOMSEC anybody?

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 16 Apr 2001 12:54:06 +0200

Hi
I think DOMSEC is a very powerful concept but it does not seem to be widely adapted
and the S/MIME-list contains almost no dicussions.

What I wonder if you out there have:

1. Any working implementions

2. A possibility to send me an entire signed DOMSEC-compatible S/MIME container

Technical questions regarding DOMSEC:

Q1: If an e-mail server is not setup for DOMSEC will the end-destination still get
the message without interoperability problems?

Q2: Are there any TTPs issuing suitable certificates today in the same way as they do for Web (domain)-servers?

Q3: Couldn't a single certificate actually serve both of these purposes?

Regards
Anders Rundgren
X-OBI

---

From: "William Ottaway" <[email-masked]>
Date: Tue, 17 Apr 2001 10:49:48 +0100

Hi Anders,

Comments below.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Anders Rundgren
> Sent: 16 April 2001 11:54
> To: [email-masked]
> Subject: DOMSEC anybody?
>
>
> Hi

We have had an implementation built for us. It is intended to have a
commercially available version soon.

> 2. A possibility to send me an entire signed DOMSEC-compatible

We are currently integrating the module into a messaging solution. Once this
has been achieved we will be able to provide DOMSEC messages.

> the message without interoperability problems?

A couple of issues spring to mind.

1) There may be a name mismatch warning due to the subject name in the
certificate being different to the sender of the message. This should not
cause interoperability. I believe that Microsoft no longer do this check.

2) There is a possibility that the innermost signature on a DOMSEC message
will contain no elements in the signerInfos. This is known as an empty
signature. There are some solutions that assume that a signedData with no
elements in the signerInfos only carries a certificate. This will cause a
problem.

Bill

>
> Q2: Are there any TTPs issuing suitable certificates today in the
> same way as they do for Web (domain)-servers?
>