Steve:
Historically, the degenerate SignedData has bee used to transfer a newly
issued certificate from the CA to the subject of the certificate (following
a PKCS#10 request).
You are proposing a new use. And, there is a PKIX specification that
covers your idea (without smimeCapabilities). Please take a look at
draft-ietf-pkix-opp-ftp-http-03.txt.
Russ
At 12:11 AM 4/21/98 +0100, Dr Stephen Henson wrote:
The V3 CMS specs support the use of degnerate signedData for
certificates only and thus usable as a means of distributing
certificates, for example on a web page.
I would suggest that what is also frequently needed is a degenerate form
that includes the SMIMECapabilities authenticated attribute. The
reasoning for this is that you not only need the recipients certificate
you also need their capabilities otherwise you have to guess
(RC2-40/triple DES) what they can handle.
It has to be authenticated otherwise an attacker could generate a
certificates only signedData with deliberately weak ciphers.
What would be the suggested way to do this? A dummy message would
achieve this end.
Alternatively a "no content with authenticated attributes" form would
work. This would contain a SignerInfo structure with signed
authenticated attributes containing signingTime and SMIMECapabilities
but would exclude the contentType and messageDigest attributes and any
content. This is currently not permitted by the CMS spec.
Steve.
--
Dr Stephen N. Henson.
UK based freelance Cryptographic Consultant. For info see homepage.
Homepage: http://www.drh-consultancy.demon.co.uk/
Email: shenson(_at_)bigfoot(_dot_)com
PGP key: via homepage.