Blake & Russ:
Actually there is a third choice which is to wrap the whole thing in a new
signature blob.
However, I am afraid that I have to agree with Blake, I think that the act
of just simply adding a signature from some unknown (and stupid) third party
should not cause the message to be unavailable. I think it is sufficent to
check for some attribute (after all you are already check for duplciates
anyway) and say that you must verify some Security Label if it exists.
jim
-----Original Message-----
From: Russ Housley [mailto:housley(_at_)spyrus(_dot_)com]
Sent: Wednesday, March 04, 1998 8:41 PM
To: Blake Ramsdell
Cc: Jim Schaad (Exchange); ietf-smime(_at_)imc(_dot_)org
Subject: RE: ESS-01 issues not finished
Blake:
I understand your concern. I just think that the resulting message will be
very confusing.
I see it this way. If a signer want to add a signature to a previousley
signed, unlabeled message, then the signer has two choices:
1. Add a signature that does not include a label.
2. Remove the previous signatures, and generate a message with a single,
labeled signature.
Russ
At 01:10 PM 3/3/98 -0800, Blake Ramsdell wrote:
On Monday, March 02, 1998 8:56 PM, Russ Housley
[SMTP:housley(_at_)spyrus(_dot_)com] wrote:
Jim:
I would prefer a stronger statement. I would like to say that if any
of
the SignerInfos includes a security label authenticated attribute,
then
all
of the SignerInfos MUST include the security label authenticated
attribute,
and the value of each MUST be identical.
I understand the intent of this. However, I believe that it is certain
that more than one entity might sign the message in sequence if there
are multiple signatures. If this is the case, if some subsequent
signature is applied with a security label, all previous signers had
better have the same security label, and likewise if a prior signature
has a security label, the new signature must have it also.
Is this reasonable to live with? I'm still mulling this over.
Blake
--
Blake C. Ramsdell
Worldtalk Corporation
For current info, check http://www.deming.com/users/blaker
Voice +1 425 882 8861 x103 Fax +1 425 882 8060