Hi,
just to check: S/MIME (http://tools.ietf.org/html/rfc5751) does not
does include/cover the 5322.From and the 5322.To fields as part of the
cryptographic payload. Protection of headers can be achieved by wrapping
up a the complete message into a message/rfc822 bodypart and
sign/encrypt that (par. 3.1 of that RFC). How is that with OpenPGP
(http://tools.ietf.org/html/rfc4880)? OpenPGP does not protect 5322.From
and 5322.To either, does it?
Par. 5.11 of RFC4880:
A User ID packet consists of UTF-8 text that is intended to represent
the name and email address of the key holder. By convention, it
includes anRFC 2822 <http://tools.ietf.org/html/rfc2822> [RFC2822
<http://tools.ietf.org/html/rfc2822>] mail name-addr, but there are no
restrictions on its content. The packet length in the header
specifies the length of the User ID.
The recipient address is not mentioned anywhere. So is the following
statement correct?:
Neither S/MIME nor OpenPGP protects the '5322.headers' of a message,
unless that message itself is wrapped up and used as body of an
enclosing S/MIME or PGP message
/rolf