pem-dev
[Top] [All Lists]

Re: S/MIME "security hole" fix

1995-09-26 08:03:00
The S/MIME Message Specification (8/29/95) does not speak to content
transfer encodings when using multipart/alternative.  So, either it is
encoded, which may result in an unreadable message if an opaque
encoding (base64) is chosen, or it may result in a clear-text message
that does not correspond exactly to the signed message if no encoding
is used.  If quoted printable is used for email that might not
otherwise make it through the network unscathed, the message will be
readable and will emerge at the other end of the pipe intact.  

Your concern that a message might not make it through the network
"unscathed" is the same one I have about MOSS.  Doesn't MOSS compute
the signature on the *encoded* data, the same data that won't make it
through unscathed?

You ommitted the last sentence of my paragraph:

Of course, MOSS will provide the same result with a message that is
less than half the size.

The context was discussion of the usefulness of S/MIME with
multipart/alternative versus MOSS for non-MIME and non-security (no
S/MIME or MOSS) aware user agents.  The point that I was trying to
make is that quoted printable encoding may be necessary to protect any
message text from inadvertent changes en route while still keeping it
readable in the raw.  

Given that the S/MIME alternative will require the same encoding as
the MOSS signed body part if it is to make it through the network
unscathed, S/MIME gains you nothing in this respect except a message
twice the size and a potential for additional ambiguity with respect
to what is signed and what you are reading.

  Mark

Attachment: binMApNvWTKwp.bin
Description: application/moss-signature

<Prev in Thread] Current Thread [Next in Thread>