Ed Gerck wrote:
On Mon, 29 Dec 1997, David Sternlight wrote:
1. It is clear that S/MIME does not intend to be a high-security standard
(such as could be used for banking purposes, for company-critical
information exchange, etc.), when you see for example the various
documented security holes that already exist and are simply discarded (to
name a few, the potential "trojan horse" situation of S/MIME private-key
generation in MSIE, the "on-line" S/MIME private-key generation with the
CA in the same session as used in NS Communicator, the question of no user
choice in the random seed generation for S/MIME private-key generation in
either case, the S/MIME use of self-signed certs, the possibility of
traceless S/MIME private-key snatching with
an ActiveX control, etc.)
E-mail is often used for purposes requiring high security/high assurance. An
open hole in a system (such as permitting anyone to self-sign a CA
certificate) is, I have argued, simply a Bad Idea. That other open holes may
exist through implementation or other problems doesn't justify it--the others
ought to be addressed as well.
As to the specifics above, if MSIE has problems they ought to be addressed by
MS, not used as a reason to weaken the standard in other areas; same for NS;
not clear how serious the random seed issue is; S/MIME's use doesn't mean this
standard can't be more robust; Active X's problems should not be a
justification for weakening this standard, "etc.".