[Top] [All Lists]

Degenerate certificates only signedData.

1998-04-20 16:23:17
The V3 CMS specs support the use of degnerate signedData for
certificates only and thus usable as a means of distributing
certificates, for example on a web page.

I would suggest that what is also frequently needed is a degenerate form
that includes the SMIMECapabilities authenticated attribute. The
reasoning for this is that you not only need the recipients certificate
you also need their capabilities otherwise you have to guess
(RC2-40/triple DES) what they can handle.

It has to be authenticated otherwise an attacker could generate a
certificates only signedData with deliberately weak ciphers.

What would be the suggested way to do this? A dummy message would
achieve this end. 

Alternatively a "no content with authenticated attributes" form would
work. This would contain a SignerInfo structure with signed
authenticated attributes containing signingTime and SMIMECapabilities
but would exclude the contentType and messageDigest attributes and any
content. This is currently not permitted by the CMS spec.

Dr Stephen N. Henson.
UK based freelance Cryptographic Consultant. For info see homepage.
Email: shenson(_at_)bigfoot(_dot_)com
PGP key: via homepage.

<Prev in Thread] Current Thread [Next in Thread>