In MOSS, for signed mail, you have two body parts. Both contain
headers followed by textual data. The signature body part, verifies
that the headers and text in the data body part are unaltered. When
you go through a gateway of any kind the text should be unaltered.
Alas, this is not good enough, as the signature is on the headers as
well. Some experiments I have tried, sending such messages through a
RFC 1327 gateway (X.400 to Internet and vice versa) show that, by
chance, the MIME headers are unaltered as well. Consequently, by
chance, the signature will verify.
There is no "by chance" about it. The MIME structure of multipart/signed offers
a clear indication to gateways that the data is signed. It is up to the gateway
to handle such material in an appropriate manner. Steve Dusse already laid out
the options in an earlier message to both the S/MIME and PEM-DEV lists, and I
followed with a long discussion of my own. Reiterating and summarizing, the
gateway can:
(1) Treat the data as a MIME entity and translate it, thus invalidating
the signature. The material in the message can be correctly processed by
the recipient though. This is the format conversion problem I talked about
in a previous message.
(2) Validate the signature, translate, and somehow provide an indication that
the signature was valid (e.g. by allowing the message through to begin with
or by signing the data itself). The loss of the original signature may or
may not be a problem.
(3) Leave the MIME material untouched and tunnel it through. The signature
remains valid, but the chances are good that a receiving X.400 agent will
not be able to interpret the result.
None of these actions are absolutely wrong. None of these actions are
absolutely right. Any of them may be appropriate, given appropriate
circumstances. It would be highly inappropriate to select one and mandate its
use in all cases.
The exact same considerations apply to S/MIME as well. The only material
difference between S/MIME and security multiparts in this regard is that
security multiparts offer the possibility of doing (1) without adding
any capabilities to the gateway. S/MIME requires that support for taking apart
PKCS#7 structures be added.
(2) is the far and away the most interesting and complicated case, and its the
one I discussed at length.
As it happens, RFC 1327 is be revised at the moment in a
specification called MIXER. What would be great is if MIXER took the
security requirements into account to remove the "by chance" element.
Again, there is no "by chance" here. Gateways have to make a choice. They
cannot avoid doing so. In the absence of security service support it boils down
to whether or not they delve inside of multipart/signed. This question has to
be answered "yes" or "no". In the case of the various PMDF gateways, for
example, its configurable to be either "yes" or "no" and defaults to "no".
I suspect that the default is "yes" in most other products. But again, there
is no "right" or "wrong" here.
My trials so far have only been for single text body part messages,
looking beyond that full MIME should not bee too hard (except X.400
UAs would need to interpret the MIME, but that should not be too hard
to do - they may have to anyway).
Unfortunately its not quite so simple. If you elect to pass the signature
on through you cannot interpret and translate the signed content. Doing so
will invalidate the signature. It has to be passed through untranslated.
Encrypted messages should work in a similar way.
Encrypted is a lot simpler, in that the gateway either knows how to undo the
encryption or it doesn't. If it does it has to choose whether or not to do so,
if it doesn't it has no choice but to tunnel the MIME content untranslated.
Consequently, what I am suggesting, is if there is some kind of cross
party discussions, maybe we are just on the verge of finding a
unifying security technology, that works as well for X.400 as for
SMTP. I cannot see any fundamental reason, why MOSS style security
should not be able to cross gateways intact. I'm not sure where we
go from here, but its surely worth contemplation for a while?
Its possible for it to cross gateways intact, but this being a desireable
outcome depends on there being MIME technology on the receiving system. This is
not guaranteed, and in fact our experience with HARPOON indicates that it won't
be.
Ned