All,
I agree with Dave's recommendation except that I believe that the user agent
MUST warn the user when non-identical eSSSecurityLabel attributes are
verified. Recommend that ESS, Sec 3.1.1, last two paras, and Sec 3.1.2,
first para, should be replaced with the following paras:
"There can be multiple SignerInfos within a SignedData object, and each
SignerInfo may include authenticatedAttributes. Therefore, a single
SignedData object may include multiple eSSSecurityLabels, each SignerInfo
having an eSSSecurityLabel attribute. For example, an originator can send a
signed message with two SignerInfos, one containing a DSS signature, the
other containing an RSA signature. If any of the SignerInfos included in
a SignedData object include an eSSSecurityLabel attribute, then all of
the SignerInfos in that SignedData object MUST include an eSSSecurityLabel
attribute and the value of each MUST be identical.
3.1.2 Processing Security Labels
Before processing an eSSSecurityLabel authenticatedAttribute, the receiving
agent MUST verify the signature of the SignerInfo which covers the
eSSSecurityLabel attribute. A recipient MUST NOT process an eSSSecurityLabel
attribute that has not been verified.
A receiving agent MUST process the eSSSecurityLabel attribute, if present,
in each SignerInfo in the SignedData object for which it verifies the
signature. This may result in the receiving agent processing multiple
eSSSecurityLabels included in a single SignedData object. Because all
eSSSecurityLabels in a SignedData object must be identical, the
receiving agent processes (such as performing access control)
on the first eSSSecurityLabel that it encounters in a SignerInfo that
it verifies, and then ensures that all other eSSSecurityLabels in
signerInfos that it verifies are identical to the first one encountered.
If the eSSSecurityLabels in the signerInfos that it verifies are not
all identical, then the receiving agent MUST warn the user of this
condition."
================================
John Pawling
jsp(_at_)jgvandyke(_dot_)com
J.G. Van Dyke & Associates, Inc.
================================