Peter Williams said, in part:
As a potential multipart/signed developer, once again Ive been considering the
interaction of multipart/signed and an SSL/HTML protocol. You may wish to
refer to
a previous thread on embedded secure URL and a discussion of non-repudiability
of message content origination proofs. The protected message content
can be financial or payment transactions, else dynamic or static
compound documents, else a host of more simple mime content types.
[snip]
Particularly Im trying to understand the implications of MOSS
with regard to multipart/mixed where a mixed bodypart can
be a dynamic document. Whilst it seems unlikely that any store-and-forward
message signature process will ever authenticate a dynamically
changing content, the issue is: what relationship is there between
the message signature and references in the multipart/signed
architecture?
Not quite true. From an integrity theory standpoint, it might be perfectly
admissable to publish the most current financial statement on a web page, using
a link that said something to the effect: "The following enclosure is subject
to periodic revision. It is to be considered valid if and only if the name of
the document continues to be: "blah" and is signed by subject="Peter Williams",
issuer="Verisign", certificate number=nnnn." This is less precise than
including the message digest or signture of the current instantiation of the
doucment, but a lot better than a totally unsubstantiated pointer.
My own answer to my own questions is (perhaps wrongly) that this
interplay specifically lies outside the semantics of multipart/signed.
Ned Freed is pretty clever -- he'll probably come up with a multipart/security
one-liner that would accomplish such a secure dynamic reference. If it can't be
done within the existing structure, I suspect he'll tell us how the construct
could be extended.
My point was that the construct is indeed reasonable, and ought to be
accomodated somehow.
Bob
Robert R. Jueneman
GTE Laboratories
1-617-466-2820 Office
1-508-264-0485 Telecommuting