Subject: [Spasm] draft-ietf-lamps-rfc5750-bis-01.txt

From: Russ Housley <[email-masked]>
Date: Mon, 7 Nov 2016 10:12:36 -0500

Section 1.3 includes:

   Appendix A contains information about algorithms are were used for
   prior versions of S/MIME but are no longer considered to meet modern
   security standards.  Support of these algorithms may be needed to
   support historic S/MIME messages but SHOULD NOT be used for new mail.

I think we need to say that the historic algorithms and smaller key sizes might be needed to decrypt or validate signatures on stored email messages.

Section 4.3 includes:

   Implementations SHOULD use deterministic generation for the parameter
   'k' for ECDSA as outlined in [RFC6979].  EdDSA is defined to generate
   this parameter deterministically.

I think we might confuse the reader here.  I think it would be better to treat ECDSA and EdDSA are tow different signature algorithms.  In this case, I think the second sentence should be deleted.

Russ

On Oct 29, 2016, at 1:22 PM, [email-masked] wrote:

> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME of the IETF.
> 
>        Title           : Secure/Multipurpose Internet Mail Extensions (S/ MIME) Version 4.0 Certificate Handling
>        Authors         : Jim Schaad
>                          Blake Ramsdell
>                          Sean Turner
> 	Filename        : draft-ietf-lamps-rfc5750-bis-01.txt
> 	Pages           : 25
> 	Date            : 2016-10-29
> 
> Abstract:
>   This document specifies conventions for X.509 certificate usage by
>   Secure/Multipurpose Internet Mail Extensions (S/MIME) v4.0 agents.
>   S/MIME provides a method to send and receive secure MIME messages,
>   and certificates are an integral part of S/MIME agent processing.
>   S/MIME agents validate certificates as described in RFC 5280, the
>   Internet X.509 Public Key Infrastructure Certificate and CRL Profile.
>   S/MIME agents must meet the certificate processing requirements in
>   this document as well as those in RFC 5280.  This document obsoletes
>   RFC 3850.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc5750-bis/
> 
> There's also a htmlized version available at:
> https://tools.ietf.org/html/draft-ietf-lamps-rfc5750-bis-01
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-rfc5750-bis-01
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Jim Schaad <[email-masked]>
Date: Mon, 7 Nov 2016 21:42:05 -0800

> -----Original Message-----
> From: Spasm [mailto:[email-masked]] On Behalf Of Russ Housley
> Sent: Monday, November 07, 2016 7:13 AM
> To: SPASM <[email-masked]>
> Subject: [Spasm] draft-ietf-lamps-rfc5750-bis-01.txt
> 
> Section 1.3 includes:
> 
> I think we need to say that the historic algorithms and smaller key sizes
might be
> needed to decrypt or validate signatures on stored email messages.

So, expand what it means to "support" historic messages?

> I think we might confuse the reader here.  I think it would be better to
treat
> ECDSA and EdDSA are tow different signature algorithms.  In this case, I
think
> the second sentence should be deleted.

I have no problems with this. 

Jim

> > This draft is a work item of the Limited Additional Mechanisms for PKIX
and
> SMIME of the IETF.
> >
> >        Title           : Secure/Multipurpose Internet Mail Extensions
(S/ MIME)
> Version 4.0 Certificate Handling
> >        Authors         : Jim Schaad
> >                          Blake Ramsdell
> >                          Sean Turner
> > Please note that it may take a couple of minutes from the time of
> > submission until the htmlized version and diff are available at
tools.ietf.org.

---

From: Sean Leonard <[email-masked]>
Date: Thu, 17 Nov 2016 16:25:39 +0900

> On Nov 8, 2016, at 2:42 PM, Jim Schaad <[email-masked]> wrote:
> 
> 
> 

Yes; I agree with Russ. Support = needed to decrypt, or validate signatures on, stored email messages.

Regards,

Sean