view Side-By-Side changes

Internet Draft                              Steve Dusse,
draft-dusse-smime-msg-01.txt
draft-dusse-smime-msg-02.txt                RSA Data Security
May
July 5, 1997                                Paul Hoffman,
Expires November January 5, 1997 1998                     Internet Mail Consortium
                                            Blake Ramsdell,
                                            Deming Internet Security
                                            Laurence Lundblade,
                                            Qualcomm
                                            Lisa Repka,
                                            Netscape

                 S/MIME Message Specification

Status of this memo

This document is an Internet-Draft. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference material
or to cite them other than as "work in progress."

To learn the current status of any Internet-Draft, please check the
"1id-abstracts.txt" listing contained in the Internet-Drafts Shadow
Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or
ftp.isi.edu (US West Coast).

1. Introduction

S/MIME (Secure/Multipurpose Internet Mail Extensions) provides a
standard way to send and receive secure MIME data. Based on the
popular Internet MIME standard, S/MIME provides the following
cryptographic security services for electronic messaging applications:
authentication, message integrity and non-repudiation of origin (using
digital signatures) and privacy and data security (using encryption).

S/MIME can be used by traditional mail user agents (MUAs) to add
cryptographic security services to mail that is sent, and to interpret
cryptographic security services in mail that is received. However,
S/MIME is not restricted to mail; it can be used with any transport
mechanism that transports MIME data, such as HTTP. As such, S/MIME
takes advantage of the object-based features of MIME and allows secure
messages to be exchanged in mixed-transport systems.

Further, S/MIME can be used in automated message transfer agents that
use cryptographic security services that do not require any human
intervention, such as the signing of software-generated documents and
the encryption of FAX messages sent over the Internet.

1.1 Specification Overview

This document describes a protocol for adding cryptographic signature
and encryption services to MIME data. The MIME standard
[MIME-SPEC] provides a general structure for the content type of
Internet messages and allows extensions for new content type
applications.

This draft defines how to create a MIME body part has been
cryptographically enhanced according to PKCS #7 [PKCS-7]. This draft
also defines the application/pkcs7-mime MIME type that can used to
transport those body parts. This draft also defines how to create
certification requests that conform to PKCS #10 [PKCS-10], and the
application/pkcs10 MIME type for transporting those request.

This draft also discusses how to use the multipart/signed MIME type
defined in [MIME-SECURE] to transport S/MIME signed messages. This
draft also defines the application/pkcs7-signature MIME type, which is
also used to transport S/MIME signed messages. This specification is
compatible with PKCS #7 in that it uses the data types defined by PKCS
#7.

In order to create S/MIME messages, an agent has to follow
specifications in this draft, as well as some of the specifications
listed in the following pre-standards works:
 - "PKCS #1: RSA Encryption Standard", [PKCS-1].
 - "PKCS #7: Cryptographic Message Syntax Standard", [PKCS-7]
 - "PKCS #9: Selected Attribute Types", [PKCS-9].
 - "PKCS #10: Certification Request Syntax Standard", [PKCS-10].

Throughout this draft, there are requirements and recommendations made
for how receiving agents handle incoming messages. There are separate
requirements and recommendations for how sending agents create
outgoing messages. In general, the best strategy is to "be liberal in
what you receive and conservative in what you send". Most of the
requirements are placed on the handling of incoming messages while the
recommendations are mostly on the creation of outgoing messages.

The separation for requirements on receiving agents and sending agents
also derives from the likelihood that there will be S/MIME systems
that involve software other than traditional Internet mail clients.
S/MIME can be used with any system that transports MIME data. An
automated process that sends an encrypted message might not be able to
receive an encrypted message at all, for example. Thus, the
requirements and recommendations for the two types of agents are
listed separately when appropriate.

1.2 Terminology

Throughout this draft, the terms MUST, MUST NOT, SHOULD, and SHOULD
NOT are used in capital letters. This conforms to the definitions in
[MUSTSHOULD].

1.3 Definitions

For the purposes of this draft, the following definitions apply.

ASN.1: Abstract Syntax Notation One, as defined in CCITT X.208.

BER: Basic Encoding Rules for ASN.1, as defined in CCITT X.209.

Certificate: A type that binds an entity's distinguished name to a
public key with a digital signature.

DER: Distinguished Encoding Rules for ASN.1, as defined in CCITT
X.509, Section 8.7.

7-bit data: Text data with lines less than 998 characters long, where
none of the characters have the 8th bit set, and there are no NULL
characters. <CR> and <LF> occur only as part of a <CR><LF> end of line
delimiter.

8-bit data: Text data with lines less than 998 characters, and where
none of the characters are NULL characters. <CR> and <LF> occur only
as part of a <CR><LF> end of line delimiter.

Binary data: Arbitrary data.

Transfer Encoding: A reversible transformation made on data so 8-bit
or binary data may be sent via a channel that only transmits 7-bit
data.

1.4 Compatibility with Pre-standards S/MIME

Appendix C contains importnat important information about how standards-based
S/MIME agents should act in order to have the greatest
interoperability with pre-standards S/MIME.

1.5 Discussion of This Draft

This draft is being discussed on the "ietf-smime" mailing list.
To subscribe, send a message to:
     ietf-subscribe-request@imc.org
with the single word
     subscribe
in the body of the message. There is a Web site for the mailing list
at <http://www.imc.org/ietf-smime/>.

2. PKCS #7 Options

The PKCS #7 message format allows for a wide variety of options in
content and algorithm support. This section puts forth a number of
support requirements and recommendations in order to achieve a base
level of interoperability among all S/MIME implementations.

2.1 DigestAlgorithmIdentifier

Receiving agents MUST support SHA-1 and MD5.

Sending agents SHOULD use SHA-1.

2.2 DigestEncryptionAlgorithmIdentifier

Receiving agents MUST support rsaEncryption, defined in [PKCS-1].
Receiving agents MUST support verification of signatures using RSA
public key sizes from 512 bits to 1024 bits.

Sending agents MUST support rsaEncryption. Outgoing messages are
signed with a user's private key. The size of the private key is
determined during key generation.

2.3 KeyEncryptionAlgorithmIdentifier

Receiving agents MUST support rsaEncryption. Incoming encrypted
messages contain symmetric keys which are to be decrypted with a
user's private key. The size of the private key is determined during
key generation.

Sending agents MUST support rsaEncryption. Sending agents MUST support
encryption of symmetric keys with RSA public keys at key sizes from
512 bits to 1024 bits.

2.4 General Syntax

The PKCS #7 defines six distinct content types: "data", "signedData",
"envelopedData", "signedAndEnvelopedData", "digestedData", and
"encryptedData". Receiving agents MUST support the "data",
"signedData", "signedAndEnvelopedData",
"signedData" and "envelopedData" content types. Sending agents may or
may not send out any of the content types, depending on the services
that the agent supports.

2.4.1 Data Content Type

Sending agents MUST use the "data" content type as the content within
other content types to indicate the message content which has had
security services applied to it.

2.4.2 Signed-data Content Type

Sending agents MUST use the Signed-data content type to apply a
digital signature to a message or, in a degenerate case where
there is no signature information, to convey information pertaining to
certificates.

2.4.3 Enveloped-data Content Type

This content type is used to apply privacy protection to a
message. A sender needs to have access to a public key for each
intended message recipient to use this service. This content type does
not provide authentication.

2.4.4 Signed-and-enveloped-data Content Type

This content type is used to apply a digital signature as well as
privacy protection to a message. A sender needs to have access to
a public key for each intended message recipient to use this service.
This content type should only be used for compatibility with [PEM].
The separate application of signing then enveloping SHOULD be used in
all other cases.

2.5 SignerInfo Type

The SignerInfo type allows the inclusion of unauthenticated and
authenticated attributes to be included along with a signature.

Receiving agents MUST be able to handle and display zero or one
instance of each of the signed attributes described in this section.

Sending agents SHOULD be able to generate one instance of each of the
signed attributes described in this section, and SHOULD include these
attributes in each signed and/or encrypted message sent.

2.5.1 Signing-Time Attribute

The signing-time attribute is used to convey the time that a message
was signed. Until there are trusted timestamping services, the time of
signing will most likely be created by a message originator and
therefore is only as trustworthy as the originator. The syntax of the
signing-time attribute is defined in [PKCS-9]. is:

SigningTime ::= UTCTime

2.5.2 SMIMECapabilities Attribute

The SMIMECapabilities attribute includes signature algorithms (such as
"md5WithRSAEncryption"), symmetric algorithms (such as "DES-CBC"), and
key encipherment algorithms (such as "rsaEncryption"). It also
includes a non-algorithm capability which is the preference
for signedData. The SMIMECapabilities were designed to be flexible and
extensible so that, in the future, a means of identifying other
capabilities and preferences such as certificates can be added in a
way that will not cause current clients to break.

The semantics of the SMIMECapabilites attribute specify a partial list
as to what the client announcing the SMIMECapabilites can support. A
client does not have to list every capability it supports, and
probably should not list all its capabilities so that the capabilities
list doesn't get too long. In an SMIMECapabilities attribute, the OIDs
are listed in order of their preference, but SHOULD be logically
separated along the lines of their categories (signature algorithms,
symmetric algorithms, key encipherment algorithms, etc.)

The structure of the SMIMECapabilities attribute is to facilitate
simple table lookups and binary comparisons in order to determine
matches. For instance, the DER-encoding for the SMIMECapability for
DES EDE3 CBC SHOULD be identically encoded regardless of the
implementation.

In the case of symmetric algorithms, the associated parameters for the
OID MUST specify all of the parameters necessary to differentiate
between two instances of the same algorithm. For instance, the number
of rounds and block size for RC5 must be specified in addition to the
key length.

There is a list of OIDs (the registered SMIMECapabilities list) that
is centrally maintained and is separate from this draft. Upon moving
this draft to standards track, the IANA will maintain the list of
OIDs. Until this draft becomes a draft standard, the list of OIDs is
maintained by the Internet Mail Consortium at
<http://www.imc.org/ietf-smime/oids.html>.

The OIDs that correspond to algorithms SHOULD use the same OID as the
actual algorithm, except in the case where the algorithm usage is
ambiguous from the OID. For instance, in an earlier draft,
rsaEncryption was ambiguous because it could refer to either a
signature algorithm or a key encipherment algorithm. In the event that
an OID is ambiguous, it needs to be arbitrated by the maintainer of
the registered SMIMECapabilities list as to which type of algorithm
will use the OID, and a new OID MUST be allocated under the
SMIMECapabilities OID to satisfy the other use of the OID.

The registered SMIMECapabilities list specifies the parameters for
OIDs that need them, most notably key lengths in the case of
variable-length symmetric ciphers. In the event that there are no
differentiating parameters for a particular OID, the parameters MUST
be omitted, and MUST NOT be encoded as NULL.

Additional values for the SMIMECapabilities attribute may be defined
in the future. Also, additional attributes and values for those
attributes may be defined in the future. Receiving agents MUST handle
a SMIMECapabilities object that has attributes or values that it does
not recognize in a graceful manner.

2.6 ContentEncryptionAlgorithmIdentifier

Receiving agents MUST support decryption and encryption using the
"FOO" RC2
algorithm [RC2] at a key size of 40 bits, hereinafter called "FOO/40". "RC2/40".
Receiving agents SHOULD support decryption using DES EDE3 CBC,
hereinafter called "tripleDES".

Sending agents SHOULD support encryption with F00/40 RC2/40 and tripleDES.

[[[Note for draft -01: Obviously, there is no "FOO" algorithm. There
is a debate on the mailing list whether the specification of any
40-bit algorithm in the draft would cause weak security. The use of
FOO/40 in this draft should help focus on that topic, hopefully to
either convince readers that no weak security is mandated, or to fix
any case where weak security is accidentally mandated. Because of
statements from RSA, it is unclear which 40-bit algorithm will be
used. The current candidates are RC2 at 40 bits (if RSA removes its
trade secret claims on RC2) and DES at 40 bits. For draft -01, it does
not matter which of these algorithms are chosen. A future version of
this draft will specify the algorithm fully or will remove the 40-bit
algorithm altogether.]]]

2.6.1 Deciding Which Encryption Method To Use

When a sending agent creates an encrypted message, it has to decide
which type of encryption to use. The decision process involves using
information garnered from the capabilities lists included in messages
received from the recipient, as well as out-of-band information such
as private agreements, user preferences, legal restrictions, and so
on.

Section 2.5 defines a method by which a sending agent can optionally
announce, among other things, its decrypting capabilities in its order
of preference. The following method for processing and remembering the
encryption capabilities attribute in incoming signed messages SHOULD
be used.

 - If the receiving agent has not yet created list of capabilities
   for the sender's public key, then, after verifying the signature
   on the incoming message and checking the timestamp, the receiving
   agent SHOULD create a new list containing at least the signing
   time and the symmetric capabilities.

 - If such a list already exists, the receiving agent SHOULD verify
   that the signing time in the incoming message is greater than
   the signing time stored in the list and that the signature is
   valid. If so, the receiving agent SHOULD update both the signing
   time and capabilities in the list. Values of the signing time that
   lie far in the future (that is, a greater discrepancy than any
   reasonable clock skew), or capabilities lists in messages whose
   signature could not be verified, SHOULD NOT be accepted.

The list of capabilities SHOULD be stored for future use in creating
messages.

Before sending a message, the sending agent MUST decide whether it is
willing to use weak encryption for the particular data in the message.
If the sending agent decides that weak encryption is unacceptable for
this data, then the sending agent MUST NOT use a weak algorithm such
as FOO/40. RC2/40. The decision to use or not use weak encryption overrides
any other decision in this section about which encryption algorithm to
use.

Sections 2.6.2.1 through 2.6.2.4 describe the decisions a sending
agent SHOULD use in deciding which type of encryption should be
applied to a message. These rules are ordered, so the sending agent
SHOULD make its decision in the order given. 

2.6.2.1 Rule 1: Known Capabilities

If the sending agent has received a set of capabilities from the
recipient for the message the agent is about to encrypt, then the
sending agent SHOULD use that information by selecting the first
capability in the list (that is, the capability most preferred by the
intended recipient) for which sending agent knows how to encrypt. The
sending agent SHOULD use one of the capabilities in the list if the
agent reasonably expects the recipient to be able to decrypt the
message.

2.6.2.2 Rule 2: Unknown Capabilities, Known Use of Encryption

If:
 - the sending agent has no knowledge of the encryption capabilities
   of the recipient,
 - and the sending agent has received at least one message from the
   recipient,
 - and the last encrypted message received from the recipient had a 
   trusted signature on it,
then the outgoing message SHOULD use the same encryption algorithm as
was used on the last signed message received from the recipient.

2.6.2.3 Rule 3: Unknown Capabilities, Risk of Failed Decryption

If:
 - the sending agent has no knowledge of the encryption capabilities
   of the recipient,
 - and the sending agent is willing to risk that the recipient may
   not be able to decrypt the message,
then the sending agent SHOULD use tripleDES.

2.6.2.4 Rule 4: Unknown Capabilities, No Risk of Failed Decryption

If:
 - the sending agent has no knowledge of the encryption capabilities
   of the recipient,
 - and the sending agent is not willing to risk that the recipient
   may not be able to decrypt the message,
then the sending agent MUST use FOO/40. RC2/40.

2.6.3 Choosing Weak Encryption

Like all algorithms that use 40 bit keys, FOO/40 RC2/40 is considered by many
to be weak encryption. A sending agent that is controlled by a human
SHOULD allow a human sender to determine the risks of sending data
using FOO/40 RC2/40 or a similarly weak encryption algorithm before sending
the data, and possibly allow the human to use a stronger encryption
method such as tripleDES.


3. Creating S/MIME Messages

This section describes the S/MIME message formats and how to create they are
created. S/MIME messages using various
body parts, some are a combination of which MIME bodies and PKCS
objects. Several MIME types as well as several PKCS objects are cryptographically processed used.
The data to be secured is always a canonical MIME entity. The MIME
entity and other data, such as described certificates and algorithm identifiers,
are given to PKCS processing facilities which produces a PKCS object.
The PKCS object is then finally wrapped in Section 2. MIME.

S/MIME provides one format for enveloped-only data, several formats
for signed-only data, and several formats for signed and enveloped
data. Several formats are required to accommodate several environments,
in particular for signed messages. The criteria for choosing among
these formats are also described.

The reader of this section is expected to understand MIME as described
in [MIME-SPEC] [MIME-SPEC], [MIME-SECURE] and [MIME-SECURE]. [APP-MIME].

3.1 Content-Type application/pkcs7-mime

This subsection defines Preparing the format of data MIME Entity for Signing or Enveloping

S/MIME is used in
application/pkcs7-mime.

3.1.1 Format to secure MIME entities. A MIME entity may be a
sub-part, sub-parts of the application/pkcs7-mime Body

PKCS #7 defines a general ASN.1 type, ContentInfo, for use in
exchanging cryptographic information. PKCS #7 also defines several
content types which can be used within a ContentInfo. For our purposes
here, the most important are SignedData (for exchanging digitally
signed data), EnvelopedData (for exchanging digitally enveloped data)
and SignedAndEnvelopedData (for exchanging data both digitally signed
and enveloped).

Therefore, when message, or the whole message with all its
sub-parts. A MIME content type application/pkcs7-mime entity that is used, the body MUST be a ContentInfo as defined by [PKCS-7], encoded using whole message includes only the Basic Encoding Rules (BER). The PKCS #7 content type SHOULD
MIME headers and MIME body, and does not include the RFC-822 headers.
Note that S/MIME can also be
SignedData, EnvelopedData or SignedAndEnvelopedData, but use of used to secure MIME entities used in
applications other
content types defined by [PKCS-7] are also allowed.

Since BER than Internet mail.

The MIME entity that is specified, instead secured and described in this section can be
thought of the more restrictive DER, an
application may use techniques such as indefinite-length encoding.
This is especially useful for transferring large data or streamed data
where the total length "inside" MIME entity. That is, it is not known the "innermost"
object in advance.

Data produced by BER what is 8-bit, but many transports are limited to
7-bit data. Therefore, in most situations, possibly a suitable 7-bit
Content-Transfer-Encoding larger MIME message. Processing "outside"
MIME entities into PKCS-7 objects is needed, such as base64.

PKCS #7 has a provision for "detached data", where, for example, the
SignedData described in the ContentInfo contains only the signature information,
but not the actual data which is signed (which is transferred
separately). S/MIME agents using application/pkcs7-mime MUST NOT use
detached data, Section 3.2, 3.4 and the data MUST be present within the ContentInfo.

PKCS #7 provides
elsewhere.

The procedure for preparing a degenerate case of SignedData which can be used
for disseminating certificates and CRLs. This MIME entity is explicitly allowed given in
application/pkcs7-mime. In this case, the content [MIME-SPEC]. The
same procedure is omitted from used here with some additional restrictions when
signing. Description of the
ContentInfo and there procedures from [MIME-SPEC] are no entries in repeated
here, but the SignerInfos, leaving only
entries reader should refer to that document for certificates and CRLs. Typically, this the exact
procedure. This section also describes additional requirements.

A single procedure is used for creating MIME entities that are to convey
certificates in response to a certification request, be
signed, enveloped, or CRLs in
response to a CRL retrieval request. The MIME agent SHOULD process and
store the certificates and CRLs both signed and may choose to display a
confirmation enveloped. Some additional steps
are recommended to the user.

The requirement defend against known corruptions that can occur
during mail transport that are of particular importance for
clear-signing using the signed multipart/signed format. It is recommended that
these additional steps be performed on enveloped messages, or signed
and enveloped data has to itself messages in order that the message can be a
MIME body part forwarded to
any environment without modification.

These steps are descriptive rather than prescriptive. The implementor
is free to use any procedure as long as the reason the protocol defined here result is called
"application/pkcs7-mime" and not "application/pkcs7". A protocol for
transferring a PKCS #7 object with arbitrary signed or enveloped
content could be defined, but the same.

  Step 1. The MIME entity is outside prepared according to the scope of this draft.

3.1.2 Format local
          conventions

  Step 2. The leaf parts of the Signed or Enveloped application/pkcs7-mime Data

PKCS #7 places no requirements on MIME entity are converted to canonical
          form

  Step 3. Appropriate transfer encoding is applied to the format leaves of
          the data which MIME entity

When an S/MIME message is
signed or enveloped. However, for use in application/pkcs7-mime, received, the
signed or enveloped data security services on the
message are removed, and the result is itself a the MIME entity. Therefore, when a That MIME
entity is typically passed to a MIME-capable user agent receives an application/pkcs7-mime object, the result of
removing where, it is
further decoded and presented to the signature user or envelope can receiving application.

3.1.1 Canonicalization

Each MIME entity MUST be passed directly converted to a canonical form that is uniquely
and unambiguously representable in the
normal MIME-processing software.

Because environment where the MIME entity being signed or enveloped signature
is likely to be
transferred to created and processed on a different platform than it was
created, the data MUST environment where the signature will be in verified.
MIME canonical format. entities MUST be canonicalized for enveloping as well as signing.

The most common difference between platforms is the end exact details of line
delimiter. There are other considerations for canonicalization depend on the selection actual MIME type
and subtype of an entity, and are not described here. Instead, the
transfer encoding
standard for the particular MIME entity that affect the ability to
verify the signature of a received MIME entity, especially if it is to type should be subsequently forwarded. The data that consulted. For
example, canonicalization of type text/plain is signed different from
canonicalization of audio/basic. Other than text types, most types
have only one representation regardless of computing platform or enveloped has to
environment which can be considered their canonical representation. In
general, canonicalization will be recovered performed by the recipient in the exact form it was produced by sending agent
rather than the
sender, so agents MUST be sure that this data be in a canonical format S/MIME implementation.

The most common and important canonicalization is for text, which can be processed by any platform. Converting a message into
canonical format is covered
often represented differently in [MIME-SPEC].

When creating a full different environments. MIME entity, entities
of major type "text" must have both their line endings and character
set canonicalized. The line ending must be the encoded sub-entities pair of characters
<CR><LF>, and the character set should be registered character set.
The details of the canonicalization are
inserted specified in [MIME-SPEC].

3.1.2 Transfer Encoding

When generating any of the full secured MIME entity. This step consists essentially of
concatenating entities below, except the sub-entities interspersed with
signing using the appropriate MIME
Content-type, Content-Transfer-Encoding, and related headers and part
boundaries. Note that MIME headers and boundaries are multipart/signed format, no transfer encoding at all text
is required.  S/MIME implementations MUST be able to deal with
canonical line endings. binary
MIME objects. If no Content-Transfer-Encoding header is present, the
transfer encoding should be considered binary.

S/MIME implementations SHOULD however use transfer encoding described
in section 3.1.3 Outside Content Transfer Encoding for all MIME entities they secure. The body of application/pkcs7-mime reason for
securing only 7-bit MIME entities, even for enveloped data that are
not exposed to the transport, is that it allows the MIME entity to be
handled in any environment without changing it. For example, a BER-encoded PKCS #7
ContentInfo. However, as mentioned above, trusted
gateway might remove the result envelope, but not the signature, of BER-encoding a
message, and then forward the signed message on to the end recipient
so that they can verify the signatures directly. If the transport
internal to the site is binary data, not 8-bit clean, such as on a wide-area
network with a single mail gateway, verifying the signature will not
be possible unless the original MIME entity was only 7-bit text. data.

3.1.3 Transfer Encoding for Signing Using multipart/signed

If S/MIME is being used in a system multipart/signed entity is EVER to be transmitted over the standard
Internet SMTP infrastructure or other transport that requires is constrained to
7-bit text, such as SMTP, a content it MUST have transfer encoding
must be used. In general, base64 Content-Transfer-Encoding can be
used, although all applied so that it is required is
represented as 7-bit text. MIME entities that the are 7-bit data already
need no transfer encoding be encoding. Entities such that application/pkcs7-mime entity as 8-bit text and binary data 
can be transferred intact. (It encoded with quoted-printable or base-64 transfer encoding.

The primary reason for the 7-bit requirement is even possible that the transfer encoding will be changed by Internet mail
transport infrastructure cannot guarantee transport of 8-bit or binary
data. Even though many segments of the transport infrastructure now
handle 8-bit and even binary data, it is sometimes not possible to
know whether transport path is 8-bit clear. If a mail message with
8-bit data were to encounter a message transfer agent, because this is explicitly permitted.)

3.1.4 Receiving an application/pkcs7-mime Body Part

These are agent that can not
transmit 8-bit or binary data, the steps agent has three options, none of
which are acceptable for receiving an application/pkcs7-mime a clear-signed message.

Step 1. Remove any content
 - The agent could change the transfer encoding.

Step 2. Examine encoding; this would
   invalidate the PKCS #7 ContentInfo to determine signature.
 - The agent could transmit the PKCS #7
content type.

Step 3. Process data anyway, which would most likely
   result in the inner content type according to PKCS #7.

Step 4. Pass 8th bit being corrupted; this too would invalidate
   the result signature
 - The agent could return the message to a standard MIME processor which removes the sender.

[MIME-SECURE] prohibits an agent from changing the transfer encoding, splits multipart entities, and possibly converts encoding
of the parts to local format.

3.2 Content-Type application/pkcs10

A typical application which allows first part of a user to generate cryptographic
information has to submit multipart/signed message. If a compliant agent
that information to can not transmit 8-bit or binary data encounters a certification
authority, who transforms
multipart/signed message with 8-bit or binary data in the first part,
it into a certificate. PKCS #10 describes a
syntax for certification requests. The application/pkcs10  body type
MUST be used would have to return the message to the sender as undeliverable.

3.1.4 Sample Canonical MIME Entity

This shows a multipart/signed message with full transfer encoding.
This message contains a PKCS #10 certification request.

The details of certification requests text part and the process of obtaining a
certificate an attachment. The sample
message text includes characters that are beyond the scope of this draft. Instead, only not US-ASCII and thus must
be transfer encoded. Though not shown here, the
format end of data used in application/pkcs10 each line is defined.

3.2.1 Format
<CR><LF>. The line ending of the application/pkcs10 Body

PKCS #10 defines the ASN.1 type CertificationRequest for use in
submitting a certification request. Therefore, when the MIME content
type application/pkcs10 is used, headers, the body MUST be a
CertificationRequest, text, and transfer
encoded using the Basic Encoding Rules (BER).

Although BER is specified, instead of parts, all must be <CR><LF>.

    Content-Type: multipart/mixed; boundary=bar

    --bar
    Content-Type: text/plain; charset=iso-8859-1
    Content-Transfer-Encoding: quoted-printable

    A1Hola Michael!

    How do you like the more restrictive DER, new S/MIME standard?

    I agree. It's generally a
typical application good idea to encode lines that begin with
    From=20because some mail transport agents will use DER since insert a greater-
    than (>) sign, thus invalidating the CertificationRequest's
CertificationRequestInfo has to signature.

    Also, in some cases it might be DER-encoded desirable to encode any   =20
    trailing whitespace that occurs on lines in order to be signed.
A robust application SHOULD output DER, but allow BER or DER on input.

Data produced by BER or DER ensure  =20
    that the message signature is 8-bit, but many transports are limited
to 7-bit data. Therefore, not invalidated when passing =20
    a suitable 7-bit Content-Transfer-Encoding
SHOULD be applied. gateway that modifies such whitespace (like BITNET). =20

    --bar
    Content-Type: application/wally-wiggle

    iQCVAwUBMJrRF2N9oWBghPDJAQE9UQQAtl7LuRVndBjrk4EqYBIb3h5QXIX/LC//
    jJV5bNvkZIGPIcEmI5iFd9boEgvpirHtIREEqLQRkYNoBActFBZmh9GC3C041WGq
    uMbrbxc+nIs1TIKlA08rVi9ig/2Yh7LFrK5Ein57U/W72vgSxLhe/zhdfolT9Brn
    HOxEa44b+EI=
    =ndaj
    --bar--

3.2 The base64 Content-Transfer-Encoding SHOULD be used
with application/pkcs10, although any 7-bit transfer encoding may
work.

3.2.2 Sending and Receiving an application/pkcs10 Body Part

For sending a certificate-signing request, the application/pkcs10
message format MUST be application/pkcs7-mime Type

The application/pkcs7-mime type is used to convey a PKCS #10 certificate-signing
request. Note that for sending carry a certificates PKCS-7 objects of
several types including envelopedData and CRLs messages
without any signedData. The details of
constructing these entities is described in subsequent sections. This
section describes the general characteristics of the
application/pkcs7-mime type.

This MIME type always carries a single PKCS-7 object. The PKCS-7
object must always be BER encoding of the ASN.1 syntax describing the
object. The contentInfo field of the carried PKCS-7 object always
contains a MIME entity that is prepared as described in section 3.1.
The contentInfo field must never be empty.

Since PKCS-7 objects are binary data, in most cases base-64 transfer
encoding is appropriate, in particular when used with SMTP transport.
The transfer encoding used depends on the transport through which
object is to be sent, and is not a characteristic of the MIME type.

Note that this discussion refers to the transfer encoding of the
PKCS-7 object or "outside" MIME entity. It is completely distinct
from, and unrelated to, the transfer encoding of the MIME entity
secured by the PKCS-7 object, the "inside" object, which is described
in section 3.1.

[Note: the following has been added to the spec, and is not in earlier
versions. It should not cause any incompatibilities with pre-standards
S/MIME implementations, and should help receiving agents.]

Because there are several types of application/pkcs7-mime objects, a
sending agent SHOULD do as much as possible to help a receiving agent
know about the contents of the object without forcing the receiving
agent to decode the ASN.1 for the object. The MIME headers of all
application/pkcs7-mime objects SHOULD include the optional
"smime-type" parameter, as described in the following sections.

3.2.1 The name and filename Parameters

For the application/pkcs7-mime, sending agents SHOULD emit the
optional "name" parameter to the Content-Type field for compatibility
with older systems. Sending agents SHOULD also emit the optional
Content-Disposition field with the "filename" parameter. If a sending
agent emits the above parameters, the value of the parameters SHOULD
be a file name with the appropriate extension:

S/MIME Type                     File Extension

application/pkcs7-mime              .p7m
(signedData, envelopedData)

application/pkcs7-mime              .p7c
(degenerate signedData
"certs-only" message)

application/pkcs7-signature         .p7s

application/pkcs10                  .p10

In addition, the file name SHOULD be limited to eight characters
followed by a three letter extension. The eight character filename
base can be any distinct name; the use of the filename "smime" SHOULD
be used to indicate that the MIME entity is associated with S/MIME.

Including a file name serves two purposes. It facilitates easier use
of S/MIME objects as files on disk. It also can convey type
information across gateways. When a MIME entity of type
application/pkcs7-mime (for example) arrives at a gateway that has no
special knowledge of S/MIME, it will default the entity's MIME type to
application/octet-stream and treat it as a generic attachment, thus
losing the type information. However, the suggested filename for an
attachment is often carried across a gateway. This often allows the
receiving systems to determine the appropriate application to hand the
attachment off to, in this case a stand-alone S/MIME processing
application. Note that this mechanism is provided as a convenience for
implementations in certain environments. A proper S/MIME
implementation MUST use the MIME types and should not rely on the file
extensions.

3.3 Creating an Enveloped-only Message

This section describes the format for enveloping a MIME entity without
signing it.

  Step 1. The MIME entity to be enveloped is prepared according to
          section 3.1.

  Step 2. The MIME entity and other required data is processed into a
          PKCS-7 object of type envelopedData.

  Step 3. The PKCS-7 object is inserted into an application/pkcs7-mime
          MIME entity.

The smime-type parameter for enveloped-only messages is
"enveloped-data". The file type for this type of message is ".p7m".

A sample message would be:

    Content-Type: application/pkcs7-mime; smime-type=enveloped-data;
         name=smime.p7m
    Content-Transfer-Encoding: base64
    Content-Disposition: attachment; filename=smime.p7m

    rfvbnj756tbBghyHhHUujhJhjH77n8HHGT9HG4VQpfyF467GhIGfHfYT6
    7n8HHGghyHhHUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H
    f8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
    0GhIGfHfQbnj756YT64V

3.4 Creating a Signed-only Message

There are two formats for signed content, messages defined for S/MIME. The
criteria for choosing among them are given in section 3.8.

3.4.1 Signing Using application/pkcs7-mime and SignedData

This signing format uses the application/pkcs7-mime message MIME type. The
steps to create this format
MUST be used are:

  Step 1. The MIME entity is prepared according to convey section 3.1

  Step 2. The MIME entity and other required data is processed into a degenerate PKCS #7
          PKCS-7 object of type signedData "certs-only"
message.

To send

  Step 3. The PKCS-7 object is inserted into an application/pkcs10 body, application/pkcs7-mime
          MIME entity

The smime-type parameter for messages using application/pkcs7-mime and
SignedData is "signed-data". The file type for this type of message is
".p7m".

A sample message would be:

    Content-Type: application/pkcs7-mime; smime-type=signed-data;
         name=smime.p7m
    Content-Transfer-Encoding: base64
    Content-Disposition: attachment; filename=smime.p7m

    567GhIGfHfYT6ghyHhHUujpfyF4f8HHGTrfvhJhjH776tbB9HG4VQbnj7
    77n8HHGT9HG4VQpfyF467GhIGfHfYT6rfvbnj756tbBghyHhHUujhJhjH
    HUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H7n8HHGghyHh
    6YT64V0GhIGfHfQbnj75

3.4.2 Signing Using the Multipart/signed Format

This format is a clear-signing format. Recipients without any S/MIME
or PKCS processing facilities are able to view the message. It makes
use of the multipart/signed MIME type described in [MIME-SECURE]. The
multipart/signed MIME type has two parts. The first part contains the
MIME entity that is to be signed; the second part contains the
signature, which is a PKCS-7 detached signature.

3.4.2.1 The application/pkcs7-signature MIME type

This MIME type always contains a single PKCS-7 object of type
signedData. The contentInfo field of the application generates PKCS-7 object must be
empty. The signerInfos field contains the
cryptographic information signatures for the user. MIME
entity. The details of the
cryptographic information registered type are beyond the scope of this draft.

Step 1. given in Appendix XX.

The cryptographic information file type for signed-only messages using
application/pkcs7-signature  is placed within ".p7s".

3.4.2.2 Creating a PKCS #10
CertificationRequest. multipart/signed Message

  Step 2. 1. The CertificationRequest MIME entity to be signed is encoded prepared according to BER or DER
(typically, DER).
          section 3.1, taking special care for clear-signing.

  Step 3. As a typical step, the DER-encoded CertificationRequest is
also base64 encoded so that it 2. The MIME entity is 7-bit data suitable for transfer presented to PKCS-7 processing in
SMTP. This then becomes the body order
          to obtain an object of type signedData with an application/pkcs10 body part. empty
          contentInfo field.

  Step 3. The result might look like this:

     Content-Type: application/pkcs10
     Content-Transfer-Encoding: base64

     rfvbnj756tbBghyHhHUujhJhjH77n8HHGT9HG4VQpfyF467GhIGfHfYT6
     7n8HHGghyHhHUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H
     f8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
     0GhIGfHfQbnj756YT64V

A typical application only needs to send a certification request. It MIME entity is a certification authority that has to receive and process the
request. The steps for recovering the CertificationRequest from the
message are straightforward but are not presented here. The procedures
for processing the certification request are beyond inserted into the scope of this
document.

3.3 Use first part of the Multipart/Signed Content-Type

[MIME-SECURE] defines the a
          multipart/signed content type explicitly for
clear-signed messages. Clear signing means the content is in the clear
so that recipients message with systems no processing other than
          that do not process PKCS information
can still read the message even if they cannot verify described in section 3.1.

  Step 4. Transfer encoding is applied to the signature.
The multipart/signed MIME type detached signature and
          it is inserted into a multipart MIME entity of type with exactly two
parts.
          application/pkcs7-signature

  Step 5. The first part carries the MIME entity being signed, and of the application/pkcs7-signature is
          inserted into the second part carries of the signature. multipart/signed entity

The multipart/signed Content type has two parameters: - The the protocol
parameter (required) - The (required), and the micalg parameter (optional) (optional).

The protocol parameter MUST be "application/pkcs7-signature". Note
that quotation marks are required around the protocol parameter
because MIME requires that the "/" character in the parameter value
MUST be quoted.

The optional micalg parameter allows for one-pass processing when the
signature is being verified. The value of the micalg parameter is
dependent on the message digest algorithm used in the calculation of
the Message Integrity Check.

An example of a multipart/signed message is:

       Content-Type: multipart/signed;
          protocol="application/pkcs7-signature";
          micalg=rsa-md5; boundary=boundary42

       --boundary42
       Content-Type: text/plain

       This is a clear-signed message
       --boundary42
       Content-Type: application/pkcs7-signature
       Content-Transfer-Encoding: base64

       ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfHfYT6
       4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbB9HGTrfvbnj
       n8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
       7GhIGfHfYT64VQbnj756
       --boundary42--

3.3.1 Preparation of the Data for Signing

The data is prepared as described in section 3.2 with the following
extra considerations for transfer encoding. All parts of the MIME
entity MUST be encoded with 7-bit, quoted-printable, or base64
transfer encoding before computing the signature. No binary or 8-bit
data is permitted. This means that receiving agents, even those on
8-bit-clean transport systems, MUST be able to remove 7-bit,
quoted-printable, or base64 transfer encoding.

The current Internet mail transport infrastructure cannot guarantee
transport of unencoded binary or 8-bit data and because the digest for
the signature is computed on the fully encoded message. If a message
with 8-bit data were to encounter a  message transfer agent (MTA) that
can not transmit 8-bit or binary data it has three options, none of
which are acceptable for a clear-signed message.
 - The MTA could change the transfer encoding, but that would
   invalidate the signature.
 - The MTA could transmit the data anyway, which would most likely
   result in the 8th bit being stripped, also resulting in be quoted.

The optional micalg parameter allows for one-pass processing when the
signature is being invalidated.
 - verified. The MTA could return value of the message to micalg parameter is
dependent on the sender.

[MIME-SECURE] prohibits an MTA from changing message digest algorithm used in the transfer encoding calculation of
the first part of Message Integrity Check.

3.4.2.3 Sample mulipart/signed message

    Content-Type: multipart/signed;
       protocol="application/pkcs7-signature";
       micalg=rsa-md5; boundary=boundary42

    --boundary42
    Content-Type: text/plain

    This is a multipart/signed clear-signed message. If a compliant MTA
encountered a
    --boundary42
    Content-Type: application/pkcs7-signature; name=smime.p7s
    Content-Transfer-Encoding: base64
    Content-Disposition: attachment; filename=smime.p7s

    ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfHfYT6
    4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbB9HGTrfvbnj
    n8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
    7GhIGfHfYT64VQbnj756
    --boundary42--

3.4.2.4 Encapsulation Using application/mime 

In some cases, multipart/signed message with 8-bit or binary data entities are automatically decomposed
in such a way as to make computing the hash of the first part, it would have to return the message to
signed part, impossible; in such a situation, the sender as
undeliverable.

Sending agents may choose signature becomes
unverifiable. In order to use quoted printable transfer encoding prevent such decomposition until the MIME
entity can be processed in
some situations where it a proper S/MIME environment, a
multipart/signed entity may not otherwise seem necessary be encapsulated in an application/mime
entity.

All S/MIME implementations SHOULD be able to better
preserve generate and receive
application/mime encapsulations of multipart/signed entities which
have their signature of type application/pkcs7-mime. In particular, on
receipt of a MIME entity of type application/mime with the data so type
parameter "multipart/signed" and the signature can be verified. For example,
trailing spaces should always protocol parameter
"application/pkcs7-mime", a receiving agent SHOULD be quoted-printable encoded able to process
the entity correctly. This is required even if the local environment
has facilities for processing application/mime because some
mail systems strip them the
application/mime standard requires that the encapsulated entity only
be processed on request of the user, or if they are not transferred with encoding.
Also processing software can
process the word "From" followed by a space at entity completely and correctly. In this case, an S/MIME
facility can always process the beginning entity completely and SHOULD do so.

The steps to create an application/mime encapsulation of a line
should be encoded
multipart/signed entity are:

  Step 1. Prepare a multipart/signed message as some mail systems convert this described in
          section 3.4.2.2

  Step 2. Insert the multipart/signed entity into an application/mime
          according to ">From".
Because [APP-MIME]. This requires that the parameters
          of the restriction multipart/signed entity be included as parameters
          on 8-bit transport it is the application/mime entity.

In addition, the application/mime entity SHOULD have a name parameter
giving a file name ending with ".aps". It SHOULD also necessary to
use quoted printable encoding for text using an 8-bit character set
such as ISO-8859-1.

3.3.2 The application/pkcs7-signature Type

The second part of have a
content-disposition parameter with the multipart/signed message MUST same filename. The ".aps"
extension SHOULD be used exclusively for application/mime encapsulated
multipart/signed entities containing a signature of type
application/pkcs7-signature. The data This is necessary so that the receiving
agent can correctly dispatch to software that verifies S/MIME
signatures in environments where the second part is MIME type and parameters have been
lost or can't be used for such dispatch. Basically, the PKCS
#7 detached signature. file extension
becomes the sole carrier of type information.

A detached signature sample application/mime encapsulation of a signed message might be:

    Content-type: application/mime; content-type="multipart/signed";
         protocol="application/pkcs7-signature";
         micalg=rsa-md5; name=smime.aps
    Content-disposition: attachment; filename=smime.aps

    Content-Type: multipart/signed;
       protocol="application/pkcs7-signature";
       micalg=rsa-md5; boundary=boundary42

    --boundary42
    Content-Type: text/plain

    This is a PKCS #7 data object
of type SignedData with very short clear-signed message. However, at least you
    can read it!

    --boundary42
    Content-Type: application/pkcs7-signature
    Content-Transfer-Encoding: base64

    ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfHfYT6
    4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbB9HGTrfvbnj
    n8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
    7GhIGfHfYT64VQbnj756
    --boundary42--


3.4.2.5 Encapsulation in an Non-MIME Environment

While this standard primarily addresses the signerInfos field containing signatures on
some external data Internet, it is useful to
compose and receive S/MIME secured messages in non-MIME
environments. This is particularly the ContentInfo field empty. In this case, the
external data case when it is desired that
security be implemented end-to-end. Other discussion here addresses
the fully encoded MIME entity described above and
placed receipt of S/MIME messages in non-MIME environments. Here the first part
composition of the multipart/signed message.

3.3.3 Procedure for Sending entities is addressed.

When a Clear Signed Message

Step 1. The data message is prepared to be sent in such an environment, the
multipart/signed entity is created as described above so the transfer
encoding of all the parts above. That entity is either 7-bit, quoted-printable or base64.

Step 2. The PKCS #7 detached signature for
then treated as an opaque stream of bits and added to the data is computed.

Step 3. The content data message as
an attachment. It must have a file name that ends with ".aps", as this
is inserted into the first part of sole mechanism for recognizing it as an S/MIME message by the
multipart/signed
receiving agent. 

When this message arrives in a MIME entity.

Step 4. The detached signature environment, it is inserted into the second part likely to have
a MIME type of application/octet-stream, with MIME parameters giving
the
multipart/signed message using appropriate transfer encoding.

3.3.4 Procedure filename for Receiving a Clear Signed Message

Step 1. The agent separates the two parts of attachment. If the multipart/signed
entity.

Step 2. The message digest of intervening gateway has
carried the first part file type, it will end in ".aps" and be recognized as an
S/MIME message.

3.5 Signing and Encrypting

To achieve signing and enveloping, any of the multipart/signed
message signed-only and
encrypted-only formats may be nested. This is computed.

Step 3. The application/pkcs7-signature information in allowed because the second part
above formats are all MIME entities, and because they all secure MIME
entities. In addition, PKCS-7 provides a data type for enveloped and
signed data, and its use is processed along with the digest obtained in the first step described here.

An S/MIME implementation MUST be able to
verify the signature.

Step 4. The MIME processing receive and decoding process
arbitrarily nested S/MIME within reasonable resource limits of the first part proceeds
and
recipient computer.

It is possible to either sign a message first, or to envelope the
message first. It is presented up to the implementor and the user along with to chose. When
signing first, the result of signatories are then securely obscured by the
signature verification.

3.4 Nesting of S/MIME Security Services

MIME allows for an arbitrarily complex structure that
enveloping. When enveloping first the signatories are exposed, but it
is frequently
limited in practice possible to a basic functional subset. While verify signatures without removing the MIME
specification allows enveloping. This
may be useful in an arbitrary depth of MIME entities nested within
other MIME entities, the addition of security services environment were automatic signature verification
is desired, as no private key material is required to verify a
signature.

3.6 Creating a Certificates-only Message

The certificates only message or MIME data
makes arbitrary nesting difficult to implement and challenging
to convey entity is used to a user transport
certificates, such as in response to a meaningful way. As with other areas in the
S/MIME specification, requirements and recommendations registration request. This
format can also be used to convey CRLs.

  Step 1. The certificates are made which
attempt available to balance the concerns of utility versus simplicity.

If PKCS-7 generating
          process which creates a user chooses to both sign PKCS object of type signedData. The
          contentInfo and envelope a message to another user,
this can signerInfos fields must be accomplished empty.

  Step 2. The PKCS-7 signedData object is enclosed in two ways:
 - by creating an
          application/pkcs7-mime MIME entity

The smime-type parameter for a PKCS #7 signedAndEnvelopedData content certs-only messages is "certs-only".
The file type
 - by separately creating a signedData content for this type then using the
   result as input of message is ".p7c".

3.7 Creating a Registration Request

A typical application which allows a user to create an envelopedData content generate cryptographic
information has to submit that information to a certification
authority, who transforms it into a certificate. PKCS #10 describes a
syntax for certification requests. The application/pkcs10 body type

Concerns have been voiced about
MUST be used to transfer a PKCS #10 certification request.

The details of certification requests and the fact that process of obtaining a
certificate are beyond the
signedAndEnvelopedData content type exposes scope of this draft. Instead, only the identities
format of data used in application/pkcs10 is defined.

3.7.1 Format of the
S/MIME signatories (i.e. Application/pkcs10 Body

PKCS #10 defines the issuerAndSerialNumber ASN.1 type CertificationRequest for each signatory
is not protected use in
submitting a certification request. Therefore, when the envelope).

In order to accommodate MIME content
type application/pkcs10 is used, the protection of signatory information within
enveloped messages all sending and receiving agents body MUST support be a
CertificationRequest, encoded using the
nesting of signed messages within enveloped messages. If an incoming
enveloped message Basic Encoding Rules (BER).

Although BER is decrypted and specified, instead of the resulting MIME entity is more restrictive DER, a
signed application/pkcs7-mime, then the user agent SHOULD
automatically process the resulting MIME entity and present
typical application will use DER since the
signature status and corresponding information CertificationRequest's
CertificationRequestInfo has to the user.

Likewise, if a user chooses be DER-encoded in order to sign and encrypt an outgoing message,
then the user agent be signed.
A robust application SHOULD automatically create an
application/pkcs7-mime signed message then use the resulting message
as input output DER, but allow BER or DER on input.

Data produced by BER or DER is 8-bit, but many transports are limited
to the creation of an application/pkcs7-mime enveloped
message. In the case of this signed/enveloped nesting, the inner
signed message 7-bit data. Therefore, a suitable 7-bit Content-Transfer-Encoding
SHOULD be left in its binary state and that the content applied. The base64 Content-Transfer-Encoding SHOULD be used
with application/pkcs10, although any 7-bit transfer encoding on may
work.

3.7.2 Sending and Receiving an application/pkcs10 Body Part

For sending a certificate-signing request, the inner signed application/pkcs10
message format MUST be indicated as binary.

There are used to convey a number of useful security functions PKCS #10 certificate-signing
request. Note that can be achieved
by allowing additional nesting of security services. An receiving
agent SHOULD allow for automatic processing of one or two additional
layers of S/MIME entities nested in other S/MIME entities. Where
additional nesting is not automatically handled, some provision SHOULD
be made to handle additional nesting manually, such as through some
explicit user action such as the resubmission of sending a certificates and CRLs messages
without any signed content, the resulting application/pkcs7-mime message format
MUST be used to convey a degenerate PKCS #7 signedData "certs-only"
message.

To send an application/pkcs10 body, the user agent.

3.5 Choosing application generates the Message Type
cryptographic information for Outgoing Signed Messages

There the user. The details of the
cryptographic information are two distinct mechanisms for conveying a signed message:

 - beyond the scope of this draft.

  Step 1. The cryptographic information is placed within a signed, self-contained application/pkcs7-mime construct
 - PKCS #10
          CertificationRequest.

  Step 2. The CertificationRequest is encoded according to BER or DER
          (typically, DER).

  Step 3. As a multipart/signed construct (where typical step, the signature DER-encoded CertificationRequest is conveyed
   separate from the signed
          also base64 encoded so that it is 7-bit data suitable for
          transfer in an application/pkcs7-signature SMTP. This then becomes the body part)

Sending agents MUST support creation of both application/pkcs7-mime
and multipart/signed messages. Therefore, receiving agents MUST be
able to process signatures from both types of messages.

In many Internet mail transactions, there is a reasonable expectation
that MIME data will be delivered intact. However, because of the
limitations inherent in an
          application/pkcs10 body part.

The result might look like this:

    Content-Type: application/pkcs10; name=smime.p10
    Content-Transfer-Encoding: base64
    Content-Disposition: attachment; filename=smime.p10

    rfvbnj756tbBghyHhHUujhJhjH77n8HHGT9HG4VQpfyF467GhIGfHfYT6
    7n8HHGghyHhHUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H
    f8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
    0GhIGfHfQbnj756YT64V

A typical application only needs to send a significant portion of existing mail
infrastructure, not all S/MIME-enabled agents will be able certification request. It
is a certification authority that has to
correctly receive and/or process multipart/signed messages. For
example, some older gateways and message transfer agents will treat
unknown multipart messages such as multipart/signed as multipart/mixed and discard process the MIME packaging
request. The steps for recovering the signed message, leading to
unverifiable signatures.

One of CertificationRequest from the greatest values of
message are straightforward but are not presented here. The procedures
for processing the multipart/signed construct is in certification request are beyond the
ability scope of agents which this
document.

3.8 Choosing a Format for Signed-only Messages

There are not S/MIME-enabled to no hard-and fast rules when a particular signed-only format
should be chosen because it depends on the capabilities of all the
receivers and the relative importance of receivers with S/MIME
facilities being able to handle verify the (otherwise unencoded) body signature versus the importance of
receivers without S/MIME software being able to view the message.

Messages signed using the message that was signed. Thus, multipart/signed SHOULD format can always be used when a signed message is being sent to
a set of recipients where viewed
by the receiver whether they have S/MIME capabilities software or not. They can
also be viewed whether they are not all known.

If the sending using a MIME-native user agent believes that or they
have messages translated by a particular recipient might not be
able gateway. In this context, "be viewed"
means the ability to receive process the message essentially as if it were not
a multipart/signed signed message, including any other MIME structure the message successfully due might
have.

Messages signed using the signedData format cannot be viewed by a
recipient unless they have S/MIME facilities. However, if they have
S/MIME facilities, these messages can always be verified if they were
not changed in transit.

3.8.1 Rationale for Multiple Signing Formats

The rationale behind the multiple formats for signing has to
improper gateways, the agent can either:
 - wrap do with
the multipart/signed message in another MIME envelope using
   application/mime, as described in [MIME-APP]
 - use application/pkcs7-mime instead subtype defaulting rules of multipart/signed

Both methods have advantages the application and multipart
top-level types, and drawbacks. Because of the newness behavior of
the specification, few currently deployed gateways would try to break open an
application/mime message, and this should thus shield
mail user agents.

Ideally, the contents
fairly well. Further, because application/mime messages are plain
text, non-MIME recipients of such a message multipart/signed format would still be able to
read it (albeit after visually parsing the message). However, only format used
because
of the newness of the specification, few of the currently-implemented
S/MIME receiving agents would know what it provides a truly backwards compatible way to do sign MIME
entities. In a pure MIME environment with an application/mime
message. All receiving S/MIME agents do know how to interpret
application/pkcs7-mime messages, so using very capable user agents,
this scheme would be possible. The world, however, is more complex than this.

One problem with the multipart/signed format occurs with gateways to
non-MIME environments. In these environments, the gateway will
generally not be S/MIME aware, will not recognize the multipart/signed
type, and will lead default its treatment to
good interpretation multipart/mixed as is
prescribed by S/MIME-aware agents. However the contents of an
application/pkcs7-mime message are indecipherable to non-S/MIME
receiving agents.

When all of MIME standard. The real problem occurs when the intended recipients are known
gateway also applies conversions to be S/MIME-capable, the sending agent SHOULD use application/pkcs7-mime because it has a
greater possibility of successful receipt through unknown gateways.
The availability MIME structure of certificates for all intended the original
message recipients
and/or S/MIME-specific entries in an addressbook or database may be a
good indication that all recipients are S/MIME-capable.

3.5.1 Sending to Mailing Lists

Sending agents often send messages to recipients on public mailing
lists is being signed and systems outside traditional Internet mail like Usenet. As
stated earlier, one is contained in the first part of the important benefits
multipart/signed structure, such as the gateway converting text and
attachments to the local format. Because the signature is over the
MIME structure of multipart/signed
messages the original message, but the original message is that their text portions
now decomposed and transformed, the signature cannot be verified.
Because MIME encoding of a particular set of body parts can be displayed (but not
verified) by non-S/MIME and by non-MIME recipients. If
application/pkcs7-mime done in
many different ways, there is used instead of multipart/signed, no way to reconstruct the
message will only be readable by recipients original MIME
entity over which the signature was computed.

A similar problem occurs when an attempt is made to combine an
existing user agent with a stand-alone S/MIME tools.
Therefore, implementors of S/MIME facility. Typical user
agents SHOULD attempt do not have the ability to ensure that
application/pkcs7-mime messages are never sent make a multipart sub-entity
available to public forums which
have participation from non-S/MIME-enabled users.

If a sending agent cannot generate multipart/signed, and stand-alone application in the same way they make leaf
MIME entities available to "viewer" applications. This user of
that agent wants to sign a message
behavior is not required by the MIME standard and thus not widely
implemented. The result is that it is being sent impossible for most user agents
to hand off the entire multipart/signed entity to a recipient
who has not explicitly advertised support for application/pkcs7-mime,
then stand-alone
application.

3.8.2 Solutions to the sender SHOULD Problem

To work around these two problems, the application/pkcs7-mime type can
be warned that some users may not used. When going through a gateway, it will be able defaulted to
read the message at all if sent in signed form, and that they should
only proceed if they are confident that all recipients have S/MIME
capability.

Because you generally cannot know all the capabilities of all the
recipients
MIME type of application/octet-stream and treated as a mailing list or similar forum, single opaque
entity. That is, the use of
application/pkcs7-mime SHOULD message will be strongly discouraged for messages
sent to these types treated as an attachment of lists and, if allowed at all, appropriate
warnings SHOULD
unknown type, converted into the local representation for an
attachment and thus can be issued.

3.5.2  Choice Matrix Summary

This chart describes made available to an S/MIME facility
completely intact. A similar result is achieved when a sending user agent SHOULD use each
similarly treats the application/pkcs7-mime MIME type: entity as a simple
leaf node of the MIME Type                        When structure and makes it available to Use

application/pkcs7-mime           When sending envelopedData

                                 When sending signedData viewer
applications.

Another way to
                                 only S/MIME-capable recipients
                                 where work around these problems is to encapsulate the
multipart/signed MIME entity in a MIME entity of type
application/mime. The result is expected similar to not arrive intact that obtained using
application/pkcs7-mime. When sending the application/mime entity arrives at a certs-only
                                 message

multipart/signed                 Default for  sending
gateway that does not recognize it, its type will be defaulted to
application/octet-stream and it will be treated as a signed
                                 message; required when sending single opaque
entity. A similar situation will happen with a
                                 signed message receiving client that
does not recognize the entity. It will usually be treated as a file
attachment. It can then be made available to the S/MIME facility.

The major difference between the two alternatives
(application/pkcs7-mime or multipart/signed wrapped with
application/mime ) is when the S/MIME facility opens the attachment.
In the latter case, the S/MIME agent will find a mix of
                                 recipients where S/MIME-
                                 capabilities are not known multipart/signed
entity rather than a BER encoded PKCS7-object. Considering the two
representations abstractly, the only difference is syntax.

The application/mime standard is a general mechanism for
                                 all recipients encapsulating
MIME, and in particular delaying its interpretation until it can be
done in the appropriate environment or at the request of the user. The
application/mime                 When sending multipart/signed specification does not permit a user agent to
                                 recipient who may
automatically interpret the encapsulated MIME unless it can be
processed entirely and properly. The parameters to the
application/mime entity give the type of the encapsulated entity so it
can be determined whether or may not the entity can be processed before it
is expanded.

Application/mime is a general encapsulation mechanism that can be
                                 S/MIME-capable and
built into a gateway or user agent, allowing expansion of the message
encapsulated entity under user control. Because it is expected to not arrive intact

application/pkcs10               When sending a certification
                                 request to a certification authority

3.6 Relationship general
mechanism, it is in many cases more likely to File-Based MIME Security

The use of be available than an
S/MIME is not limited facility. Thus, it enables users to the on-line mail environment. By
associating standard file extensions expand or to the various S/MIME content
types, useful automatic conversion can occur between agents verify signed
messages based on their local facilities and
file-based S/MIME processing capabilities in a receiving agent or at choices. It provides
exactly the operating system level. The MIME Content-Type header field has an
optional parameter, "name", same advantages that is useful for saving body parts on
disk at the recipient's site. The MIME Content-Disposition header
field, application/pkcs7-mime with the value "attachment"
signedData does. It also has an optional parameter,
"filename", for saving body parts on disk at the recipient's site.

Sending agents SHOULD emit the optional name parameter to the
Content-Type field for added benefit of allowing expansion
in non S/MIME environments and expansion under the recipients control
in.

3.8.3 Deciding Which Format To Use

The following table gives criteria for compatibility with older systems.
Sending agents SHOULD emit selecting the optional Content-Disposition field with signature message
format in order of preference if the filename parameter. criteria is met:

    mulipart/signed
        If a sending agent emits a Content-Disposition
field with the filename parameter, it MUST use the file extensions
listed below that is consistent with the content type. Both of these
parameters SHOULD be set to the same filename with extension.

For support of legacy systems (i.e. DOS) unknown whether or not all the filename should be
limited to eight characters followed by a period followed by a three
letter extension. The eight character filename base can be any
distinct name; recipients have
           S/MIME processing facilities and
        It is unknown whether or not the use of have the filename "smime" SHOULD be used ability to
indicate process
           the application/mime type and
        It is more important that the MIME entity message be read by all
           recipients than it be verifiable

    application/mime
        It is associated with S/MIME.

The filename extensions MUST correspond known that all recipients have the ability to process
          messages of the type application/mime
        It does not matter whether or not they have S/MIME message types
from this table:

S/MIME Type                     File Extension
                           
application/pkcs7-signature         .p7s
                  

application/pkcs7-mime              .p7m
(for signedData and        
envelopedData)

application/pkcs7-mime              .p7c
(degenerate facilities

    signedData     
"certs-only" message)

application/pkcs10                  .p10

For instance:

Content-Type: application/pkcs7-mime;name="smime.p7m"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;filename="smime.p7m"

<base64 data goes here>

If this message were
        It is known that all recipients have S/MIME facilities

The sender may determine whether or not a recipient has S/MIME
facilities by keeping track of type application/pkcs10, then the filename
would be something like "smime.p10". messages they have received from that
person in an address book or other facility. If they have received
S/MIME constructs are saved to or imported messages from disk, the same file
extensions SHOULD be used. This allows for static registry of the
filename extension and a particular associated "helper" application address, is it safe to conclude that
S/MIME messages may be sent to that address.

3.9 Identifying an S/MIME Message

Because S/MIME takes into account interoperation in
certain application environments.

Certain older MIME agents and gateways automatically convert unknown
subtypes of non-MIME
environments, several different mechanisms are employed to carry the MIME "application"
type information, and it becomes a bit difficult to application/octet-stream.
Sending agents including identify S/MIME
messages. The following table lists criteria for determining whether
or not a message is an S/MIME message. A message is considered an
S/MIME message if it matches any below.

The file suffix in the optional name table below comes from the "name" parameter and in
the optional
Content-Disposition: attachment;filename= content-type header, or the "filename" parameter give at least some
indication on the
content-disposition header. These parameters that give the included MIME entity is an S/MIME entity. S/MIME
agents and "helper" applications SHOULD be capable file suffix
are not listed below as part of processing the parameter section.

MIME type:   application/pkcs7-mime
parameters:  any
file suffix: any
      
MIME type:   mulitpart/signed
parameters:  protocol="application/pkcs7-signature"
file suffix: any
      
MIME type:   application/mime
parameters:  content-type="multipart/signed";
                protocol="application/pkcs7-signature"
file suffix: any
      
MIME type:   application/octet-stream messages with recognized S/MIME filename
extensions either automatically or by explicit user action.
parameters:  any
file suffix: p7m, p7s, aps, p7c, p10


4. Certificate Processing

A receiving agent MUST provide some certificate retrieval mechanism in
order to gain access to certificates for recipients of digital
envelopes. This draft does not cover how S/MIME agents handle
certificates, only what they do after a certificate has been validated
or rejected. S/MIME certification issues are covered in a different
document.

At a minimum, for initial S/MIME deployment, a user agent could
automatically generate a message to an intended recipient requesting
that recipient's certificate in a signed return message. Receiving and
sending agents SHOULD also provide a mechanism to allow a user to
"store and protect" certificates for correspondents in such a way so
as to guarantee their later retrieval.

4.1 Key Pair Generation

An S/MIME agent or some related administrative utility or function MUST
be capable of generating RSA key pairs on behalf of the user. Each key
pair MUST be generated from a good source of non-deterministic
random input and protected in a secure fashion.

A user agent SHOULD generate RSA key pairs at a minimum key size of
768 bits and a maximum key size of 1024 bits. A user agent SHOULD NOT
generate RSA key pairs less than 512 bits long. Some agents created in
the United States have chosen to create 512 bit keys in order to get
more advantageous export licenses. However, 512 bit keys are
considered by many to be cryptographically insecure.

5. Security

This entire draft discusses security. Security issues not covered in
other parts of the draft include:

40-bit encryption is considered weak by most cryptographers. Using
weak cryptography in S/MIME offers little actual security over sending
plaintext. However, other features of S/MIME, such as the
specification of tripleDES and the ability to announce stronger
cryptographic capabilities to parties with whom you communicate, allow
senders to create messages that use strong encryption. Using weak
cryptography is never recommended unless the only alternative is no
cryptography. When feasable, feasible, sending and receiving agents should
inform senders and recipients the relative cryptographic strength of
messages.

It is impossible for most software or people to estimate the value of
a message. Further, it is impossible for most software or people to
estimate the actual cost of decrypting a message that is encrypted
with a key of a particular size. Further, it is quite difficult to
determine the cost of a failed decryption if a recipient cannot decode
a message. Thus, choosing between different key sizes (or choosing
whether to just use plaintext) is also impossible. However, decisions
based on these criteria are made all the time, and therefore this
draft gives a framework for using those estimates in choosing
algorithms.


Appendix A - Object Identifiers & Syntax

The syntax for SMIMECapability is:

SMIMECapability ::= SEQUENCE {
    capabilityID OBJECT IDENTIFIER,
    parameters OPTIONAL ANY DEFINED BY capabilityID }

SMIMECapabilities ::= SEQUENCE OF SMIMECapability

A.1 Content Encryption Algorithms

RC2-CBC OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 2}

For the effective-key-bits (key size) other than 32 and less than
256, the RC2-CBC algorithm parameters are encoded as:

RC2-CBC parameter ::=  SEQUENCE {
     rc2ParameterVersion  INTEGER,
     iv                   OCTET STRING (8)}

For the effective-key-bits of 40, 64, and 128, the
rc2ParameterVersion values are 160, 120, 58 respectively.

DES-EDE3-CBC OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 7}

For DES-CBC and DES-EDE3-CBC, the parameter should be encoded as:

CBCParameter :: IV

where IV ::= OCTET STRING -- 8 octets.

A.2 Digest Algorithms

md5 OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) digestAlgorithm(2) 5}

sha-1 OBJECT IDENTIFIER ::=
     {iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2) 26}

A.3 Asymmetric Encryption Algorithms

rsaEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 1}

rsa OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) algorithm(8) encryptionAlgorithm(1) 1}

A.3 Signature Algorithms

md2WithRSAEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 2}

md5WithRSAEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 4}

sha-1WithRSAEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5}

A.4 Signed Attributes

signingTime OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-9(9) 5}


B. References

[MIME-APP] "Wrapping MIME Objects:  Application/MIME", Internet
Draft draft-crocker-wrap-01.txt.

[MIME-SPEC] The primary definition of MIME. "MIME Part 1: Format of
Internet Message Bodies", RFC 2045; "MIME Part 2: Media Types", RFC
2046; "MIME Part 3: Message Header Extensions for Non-ASCII Text", RFC
2047; "MIME Part 4: Registration Procedures", RFC 2048; "MIME Part 5:
Conformance Criteria and Examples", RFC 2049

[MIME-SECURE] "Security Multiparts for MIME: Multipart/Signed and
Multipart/Encrypted", RFC 1847

[MUSTSHOULD] "Key words for use in RFCs to Indicate Requirement  
Levels", RFC 2119

[PEM] "Privacy-Enhanced Mail (PEM) basics", RFC 1421

[PKCS-1], "PKCS #1: RSA Encryption", draft has been submitted for RFC
status Internet Draft
draft-hoffman-pkcs-rsa-encrypt

[PKCS-7], "PKCS #7: Cryptographic Message Syntax", draft has been
submitted for RFC status

[PKCS-9], "PKCS #9: Selected Attribute Types", submission of draft
pending Internet Draft
draft-hoffman-pkcs-crypt-msg

[PKCS-10], "PKCS #10: Certification Request Syntax", draft has been
submitted for RFC status Internet Draft
draft-hoffman-pkcs-certif-req

[RC2] "Description of the RC2 Encryption Algorithm", Internet Draft
draft-rivest-rc2desc


C. Compatibility with Pre-standards S/MIME

S/MIME was originally developed by RSA Data Security, Inc. Many
developers implemented S/MIME agents before the standard was turned
over to the IETF. All S/MIME receiving agents SHOULD make every attempt to
interoperate with pre-standards S/MIME sending agents.

C.1 Pre-standards MIME Types

Pre-standard S/MIME agents used the following MIME types:

application/x-pkcs7-mime
application/x-pkcs7-signature
application/x-pkcs10

In each case, the "x-" subtypes correspond to the subtypes described
in this document without the "x-".

C.2 Pre-standards Profiles

Pre-standard S/MIME had two profiles for encryption: "restricted" and
"unrestricted". The difference between these profiles historically
came about due to US Government export regulations, as described at
the end of this section. It is expected that in the future, there will
be few agents that only use the restricted profile.

Briefly, the restricted profile required the ability to encrypt and
decrypt using RSA's trade-secret RC2 algorithm in CBC mode with 40-bit
keys. The unrestricted profile required the ability to encrypt and
decrypt using RSA's trade-secret RC2 algorithm in CBC mode with 40-bit
keys, and to encrypt and decrypt using tripleDES. The restricted
profile also had non-manditory suggestions for other algorithms, but
these were not widely implemented.

It is important to note that many current implementations of S/MIME
use the restricted profile.

C.2.1 Historical Reasons for the Existence of Two Encryption Profiles

Due to US Government export regulations, an S/MIME agent which
supports a strong content encryption algorithm such as DES would not
be freely exportable outside of North America. US software
manufacturers have been compelled to incorporate an exportable or
"restricted" content encryption algorithm in order to create a widely
exportable version of their product. S/MIME agents created in the US
and intended for US domestic use (or use under special State
Department export licenses) can utilize stronger, "unrestricted"
content encryption. However, in order to achieve interoperability,
such agents need to support whatever exportable algorithm is
incorporated in restricted S/MIME agents.

The RC2 symmetric encryption algorithm has been approved by the US
Government for "expedited" export licensing at certain key sizes.
Consequently, support for the RC2 algorithm in CBC mode is required
for baseline interoperability in all S/MIME implementations. Support
for other strong symmetric encryption algorithms such as RC5 CBC, DES
CBC and DES EDE3-CBC for content encryption is strongly encouraged
where possible.

D. Revision History

The following changes were made between the -00 and -01 revisions of
this draft:

Some instances of "MUST" were de-capitalized or changed to words like
"need to" because they didn't specify absolute requirements.

Changed many instances of "MIME message" to "MIME data" to clarify
the fact that MIME parts are data, not messages.

Added Section 1.2 about MUST and SHOULD.

Added Section 1.5 about the mailing list and Web site for the draft.

Added "and SHOULD include these attributes in each signed and/or
encrypted message sent" to the last sentence of section 2.5.

Changed Section 2.6 into a single protocol. This caused major shifts
and lots of rewording in the section. Removed completely the concept
of "profiles."

Temporarily changed "RC2 CBC, key size 40 bits" to "FOO/40" and
explained why.

Removed MUST support in Section 2.6 for everything other than FOO/40,
and changed tripleDES to SHOULD.

Removed SHOULD lists DES EDE3-CBC for receiving content encryption is strongly encouraged
where possible.


D. Revision History

The following changes were made between the -01 and sending agents in Section 2.6.

Capitalized -02 revisions of
this draft:

Changed the SHOULDs in "FOO" from the capabilities list discussion in previous Section 2.6.3. Also, reworded parts draft back to reflect that all
capabilities should be recorded.

Added wording in previous Section 2.6.3.3 that messages used RC2 and gave a
reference to
determine the encryption capabilities must have trusted signatures.

Changed the wording in Section 4.1 to reflect what is
cryptographically sound; also shortened discussion of US export. Internet Draft describing it. Added Section 5 on security, and described back the rationale
OIDs for using
40-bit keys as RC2 in Appendix A.

All of section 3 was completely replaced.

Updated the basis for S/MIME and why it is impossible reference section to
accurately choose a key size point to Internet Drafts for a particular message. PKCS
docs.

Removed OIDs from Appendix A.1 that were removed from Section 2.6.

Clarified the wording reference to PKCS #9 in Appendix G about 2.5.1 by stating the status of syntax.

Removed signedAndEnveloped from the S/MIME
name. draft.


E. Request for New MIME Subtypes

E.1 application/pkcs7-mime

To: ietf-types@iana.org
Subject: Registration of MIME media type application/pkcs7-mime

MIME media type name: application

MIME subtype name: pkcs7-mime

Required parameters: none

Optional parameters: none

Encoding considerations: Will be binary data, therefore should use
base64 encoding

Security considerations: Described in [PKCS-7]

Interoperability considerations: Designed to carry data formatted
with PKCS-7, as described in [PKCS-7]

Published specification: draft-dusse-smime-msg-xx

Applications which use this media type: Secure Internet mail and
other secure data transports.

Additional information:
File extension(s): .p7m and .p7c
Macintosh File Type Code(s):

Person & email address to contact for further information:
Steve Dusse, spock@rsa.com

Intended usage: COMMON

E.2 application/pkcs7-signature

To: ietf-types@iana.org
Subject: Registration of MIME media type application/pkcs7-signature

MIME media type name: application

MIME subtype name: pkcs7-signature

Required parameters: none

Optional parameters: none

Encoding considerations: Will be binary data, therefore should use
base64 encoding

Security considerations: Described in [PKCS-7]

Interoperability considerations: Designed to carry digital
signatures with PKCS-7, as described in [PKCS-7]

Published specification: draft-dusse-smime-msg-xx

Applications which use this media type: Secure Internet mail and
other secure data transports.

Additional information:
File extension(s): .p7s
Macintosh File Type Code(s):

Person & email address to contact for further information:
Steve Dusse, spock@rsa.com

Intended usage: COMMON

E.3 application/pkcs10

To: ietf-types@iana.org
Subject: Registration of MIME media type application/pkcs10

MIME media type name: application

MIME subtype name: pkcs10

Required parameters: none

Optional parameters: none

Encoding considerations: Will be binary data, therefore should use
base64 encoding

Security considerations: Described in [PKCS-10]

Interoperability considerations: Designed to carry digital
certificates formatted with PKCS-10, as described in [PKCS-10]

Published specification: draft-dusse-smime-msg-xx

Applications which use this media type: Secure Internet mail and
other transports where certificates are required.

Additional information:
File extension(s): .p10
Macintosh File Type Code(s):

Person & email address to contact for further information:
Steve Dusse, spock@rsa.com

Intended usage: COMMON


F. Open Issues

Section 3 is being reordered to make it easier to implement from. At
the same time, we need to look at:
 - new wording for section 3.5's "improper gateways" discussion.
   Need to make it clear that multipart/signed is always strongly
   preferred.
 - add back the description of how to do content transfer encoding.
 - look at whether nesting should be restricted like it is now.
 - whether or not to allow 8-bit data in signedData and envelopedData
   body parts, or must everything be forced to 7-bit first.

Make the micalg parameter required, not optional.

Need reference to allowed values for the micalg parameter in 3.4.2.2.

What to do if sending to multiple people with different known
capabilities? What if sending to a group, some of whom have
known capabilities, others with unknown?

Do we need better heuristics for determining the encryption
capabilities of a recipient? What about guessing based on
key length?

In section 3.4.2.4, we need to look at whether the SHOULDs should
be MUSTs.

References to the encryption and hash algorithms.

Use of the S/MIME trademark.

Include an appendix with the proper requests for new MIME subtypes.

Need to list text values for the micalg parameter of multipart/signed.
RFC 1848 lists only "RSA-MD2" and "RSA-MD5", not "SHA-1".

What does PEM compatibility mean/entail, and do we care?

Look at the use of PKCS-7 "data" format.

Remove and/or deprecate signedAndEnveloped in the draft.

Remove the reference to PKCS-9.


G.  Trademarks

RSA Data Security, Inc., owns the US trademark for the name "S/MIME"
and for a logo associated with that name. RSA Data Security, Inc., is
considering allowing the use of the name for work done in the IETF.
The name "S/MIME" may or may not be used in future versions of this
draft.


H. Acknowledgements

Significant contributions to the content of this draft were made by
many people, including:
Jeff Thompson
Jeff Weinstein


I. Authors' addresses

Steve Dusse
RSA Data Security, Inc. 
100 Marine Parkway, #500 
Redwood City, CA  94065  USA  
(415) 595-8782
spock@rsa.com

Paul Hoffman
Internet Mail Consortium
127 Segre Place
Santa Cruz, CA  95060
(408) 426-9827
phoffman@imc.org

Blake Ramsdell
Deming Internet Security
13122 NE 20th St., Suite C
Bellevue, WA 98005
(206) 882-8861
blaker@deming.com

Laurence Lundblade
QUALCOMM Incorporated
Eudora Division 
6455 Lusk Boulevard 
San Diego, California 92121-2779
(800) 238-3672
lgl@qualcomm.com

Lisa Repka
Netscape Communications Corporation
501 East Middlefield Road
Mountain View, CA  94043
(415) 254-1900
repka@netscape.com



----