Subject: SMIME and disclaimers

From: [email-masked]
Date: Mon, 17 Feb 2003 16:24:33 +0000

All,

I don't imagine for a moment that we're the only ones looking at this issue.

Discounting whether disclaimers carry any worthwhile legal weight, technically
is it feasible to add a disclaimer to outgoing SMIME messages at the outgoing
server without breaking the signature ? The multipart nature of MIME suggests
that it is at least plausible to place the disclaimer in its own MIME boundary
such that it doesn't interfere with signed portions in the parts of the message
that originate at the client.

Opinions appreciated.

Chris

Royal Mail is a trading name of Royal Mail Group plc. Registered in England and
Wales.
Registered number 4138203. Registered office at 148 Old Street, LONDON EC1V 9HQ

This  email  and  any  attachments  are confidential and intended for the addressee
only.   If  you are not the named recipient, you must not use, disclose, reproduce,
copy  or  distribute the contents of this communication.  If you have received this
in error, please contact the sender and then delete this email from your system.

---

From: Marc Mutz <[email-masked]>
Date: Mon, 17 Feb 2003 19:19:02 +0100

On Monday 17 February 2003 17:24, [email-masked] wrote:
<snip>
> The multipart nature of MIME suggests
> that it is at least plausible to place the disclaimer in its own MIME
> boundary such that it doesn't interfere with signed portions in the
> parts of the message that originate at the client.
<snip>

The application adding the disclaimer needs to be fully MIME-aware and 
needs to be able to re-arrange the MIME body parts if necessary. Just 
appending the disclaimer in plain text, US-ASCII form works only for 
messages with text/plain top-level content-type and a charset that 
contains US-ASCII as a subset (e.g. iso-8859-*, utf-8).

A more intelligent approach would be to find the last MIME boundary, 
remove everything after and including the trailing double hyphen, and 
add something like:
Content-Type: text/plain; charset=us-ascii
Content-disposition: inline

<disclaimer goes here>
--boundary--
but that fails for multiparts with a fixed number of required children, 
e.g. multipart/signed, which needs to have exactly two children.

For coping with these messages, you have three options:
1. Lock down the signature (not the digital signature, but the message
   footer) to use for your users, if your mailer supports that (e.g.
   KMail does), so it includes the disclaimer and cannot be changed by
   the user.
2. Use an application that is dumb and just appends the disclaimer as
   text, like e.g. mailman does. Then you have to hope that all the
   recipients use MUAs that show the epilogue of mails if it looks
   interesting. Don't hold your breath...
3. Use an intelligent application to append the disclaimer, one that can
   re-arrange the MIME body structure to fold the current content into
   an additional multipart/mixed if needed to append the text/plain
   disclaimer and hope that recipient's clients can cope with deeply
   nested MIME body structures.

I guess your best bet is to look up the admin's handbook of your users' 
MUAs and see if (1) is an option.

Marc

-- 
"You're hackers, aren't you," the barman said, eyeing us. No one said
a thing. The darkness of the Eurotunnel rolled by. Apparently we'd
given ourselves away by talking too enthusiastically about IPv6. He
looked around conspiratorially, lowered his voice. "Can you get me
some credit card numbers?"
      -- James J. King "What's the shortest way to hack a Linux box?"
         Telepolis 2001/08/11 (#9293)