[Docs] [txt|pdf] [Tracker] [Email] [Nits]

Versions: 00 01 02 03 04 05 06 RFC 2311

Internet Draft                              Steve Dusse,
draft-dusse-smime-msg-00.txt                RSA Data Security
March 25, 1997                              Paul Hoffman,
Expires September 25, 1997                  Internet Mail Consortium
                                            Blake Ramsdell,
                                            Deming Internet Security
                                            Laurence Lundblade,
                                            Qualcomm
                                            Lisa Repka,
                                            Netscape

                 S/MIME Message Specification

Status of this memo

This document is an Internet-Draft. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference material
or to cite them other than as "work in progress."

To learn the current status of any Internet-Draft, please check the
"1id-abstracts.txt" listing contained in the Internet-Drafts Shadow
Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or
ftp.isi.edu (US West Coast).

1. Introduction

S/MIME (Secure/Multipurpose Internet Mail Extensions) provides a
standard way to send and receive secure MIME messages. Based on the
popular Internet MIME standard, S/MIME provides the following
cryptographic security services for electronic messaging applications:
authentication, message integrity and non-repudiation of origin (using
digital signatures) and privacy and data security (using encryption).

S/MIME can be used by traditional mail user agents (MUAs) to add
cryptographic security services to mail that is sent, and to interpret
cryptographic security services in mail that is received. However,
S/MIME is not restricted to mail; it can be used with any transport
mechanism that transports MIME messages, such as HTTP. As such, S/MIME
takes advantage of the object-based features of MIME and allows secure
messages to be exchanged in mixed-transport systems.

Further, S/MIME can be used in automated message transfer agents that
use cryptographic security services that do not require any human
intervention, such as the signing of software-generated documents and
the encryption of FAX messages sent over the Internet.

1.1 Specification Overview

This document describes a protocol for adding cryptographic signature
and encryption services to Internet MIME messages. The MIME standard
[MIME-SPEC] provides a general structure for the content type of
Internet messages and allows extensions for new content type
applications.

This draft defines how to create a MIME body part has been
cryptographically enhanced according to PKCS #7 [PKCS-7]. This draft
also defines the application/pkcs7-mime MIME type that can used to
transport those body parts. This draft also defines how to create
certification requests that conform to PKCS #10 [PKCS-10], and the
application/pkcs10 MIME type for transporting those request.

This draft also discusses how to use the multipart/signed MIME type
defined in [MIME-SECURE] to transport S/MIME signed messages. This
draft also defines the application/pkcs7-signature MIME type, which is
also used to transport S/MIME signed messages. This specification is
compatible with PKCS #7 in that it uses the data types defined by PKCS
#7.

In order to create S/MIME messages, an agent has to follow
specifications in this draft, as well as some of the specifications
listed in the following pre-standards works:
 - "PKCS #1: RSA Encryption Standard", [PKCS-1].
 - "PKCS #7: Cryptographic Message Syntax Standard", [PKCS-7]
 - "PKCS #9: Selected Attribute Types", [PKCS-9].
 - "PKCS #10: Certification Request Syntax Standard", [PKCS-10].

Throughout this draft, there are requirements and recommendations made
for how receiving agents handle incoming messages. There are separate
requirements and recommendations for how sending agents create
outgoing messages. In general, the best strategy is to "be liberal in
what you receive and conservative in what you send". Most of the
requirements are placed on the handling of incoming messages while the
recommendations are mostly on the creation of outgoing messages.

The separation for requirements on receiving agents and sending agents
also derives from the likelihood that there will be S/MIME systems
that involve software other than traditional Internet mail clients.
S/MIME can be used with any system that transports MIME messages. An
automated process that sends an encrypted message might not be able to
receive an encrypted message at all, for example. Thus, the
requirements and recommendations for the two types of agents are
listed separately when appropriate.

1.3 Definitions

For the purposes of this draft, the following definitions apply.

ASN.1: Abstract Syntax Notation One, as defined in CCITT X.208.

BER: Basic Encoding Rules for ASN.1, as defined in CCITT X.209.

Certificate: A type that binds an entity's distinguished name to a
public key with a digital signature.

DER: Distinguished Encoding Rules for ASN.1, as defined in CCITT
X.509, Section 8.7.

7-bit data: Text data with lines less than 998 characters long, where
none of the characters have the 8th bit set, and there are no NULL
characters. <CR> and <LF> occur only as part of a <CR><LF> end of line
delimiter.

8-bit data: Text data with lines less than 998 characters, and where
none of the characters are NULL characters. <CR> and <LF> occur only
as part of a <CR><LF> end of line delimiter.

Binary data: Arbitrary data.

Transfer Encoding: A reversible transformation made on data so 8-bit
or binary data may be sent via a channel that only transmits 7-bit
data.

1.4 Compatibility with Pre-standards S/MIME

Appendix C contains importnat information about how standards-based
S/MIME agents should act in order to have the greatest
interoperability with pre-standards S/MIME.

2. PKCS #7 Options

The PKCS #7 message format allows for a wide variety of options in
content and algorithm support. This section puts forth a number of
support requirements and recommendations in order to achieve a base
level of interoperability among all S/MIME implementations.

2.1 DigestAlgorithmIdentifier

Receiving agents MUST support SHA-1 and MD5.

Sending agents SHOULD use SHA-1.

2.2 DigestEncryptionAlgorithmIdentifier

Receiving agents MUST support rsaEncryption, defined in [PKCS-1].
Receiving agents MUST support verification of signatures using RSA
public key sizes from 512 bits to 1024 bits.

Sending agents MUST support rsaEncryption. Outgoing messages are
signed with a user's private key. The size of the private key is
determined during key generation.

2.3 KeyEncryptionAlgorithmIdentifier

Receiving agents MUST support rsaEncryption. Incoming encrypted
messages contain symmetric keys which are to be decrypted with a
user's private key. The size of the private key is determined during
key generation.

Sending agents MUST support rsaEncryption. Sending agents MUST support
encryption of symmetric keys with RSA public keys at key sizes from
512 bits to 1024 bits.

2.4 General Syntax

The PKCS #7 defines six distinct content types: "data", "signedData",
"envelopedData", "signedAndEnvelopedData", "digestedData", and
"encryptedData". Receiving agents MUST support the "data",
"signedData", "signedAndEnvelopedData", and "envelopedData" content
types. Sending agents may or may not send out any of the content
types, depending on the services that the agent supports.

2.4.1 Data Content Type

Sending agents MUST use the "data" content type as the content within
other content types to indicate the MIME message content which has had
security services applied to it.

2.4.2 Signed-data Content Type

Sending agents MUST use the Signed-data content type to apply a
digital signature to a MIME message or, in a degenerate case where
there is no signature information, to convey information pertaining to
certificates.

2.4.3 Enveloped-data Content Type

This content type is used to apply privacy protection to a MIME
message. A sender MUST have access to a public key for each intended
message recipient to use this service. This content type does not
provide authentication.

2.4.4 Signed-and-enveloped-data Content Type

This content type is used to apply a digital signature as well as
privacy protection to a MIME message. A sender MUST have access to a
public key for each intended message recipient to use this service.
This content type should only be used for compatibility with [PEM].
The separate application of signing then enveloping SHOULD be used in
all other cases.

2.5 SignerInfo Type

The SignerInfo type allows the inclusion of unauthenticated and
authenticated attributes to be included along with a signature.

Receiving agents MUST be able to handle and display zero or one
instance of each of the signed attributes described in this section.

Sending agents SHOULD be able to generate one instance of each of the
signed attributes described in this section.

2.5.1 Signing-Time Attribute

The signing-time attribute is used to convey the time that a message
was signed. Until there are trusted timestamping services, the time of
signing will most likely be created by a message originator and
therefore is only as trustworthy as the originator. The syntax of the
signing-time attribute is defined in [PKCS-9].

2.5.2 SMIMECapabilities Attribute

The SMIMECapabilities attribute includes signature algorithms (such as
"md5WithRSAEncryption"), symmetric algorithms (such as "DES-CBC"), and
key encipherment algorithms (such as "rsaEncryption"). It also
currently includes a non-algorithm capability which is the preference
for signedData. The SMIMECapabilities were designed to be flexible and
extensible so that, in the future, a means of identifying other
capabilities and preferences such as certificates can be added in a
way that will not cause current clients to break.

The semantics of the SMIMECapabilites attribute specify a partial list
as to what the client announcing the SMIMECapabilites can support. A
client does not have to list every capability it supports, and
probably should not list all its capabilities so that the capabilities
list doesn't get too long. In an SMIMECapabilities attribute, the OIDs
are listed in order of their preference, but SHOULD be logically
separated along the lines of their categories (signature algorithms,
symmetric algorithms, key encipherment algorithms, etc.)

The structure of the SMIMECapabilities attribute is to facilitate
simple table lookups and binary comparisons in order to determine
matches. For instance, the DER-encoding for the SMIMECapability for
RC2-CBC with a 40-bit key length MUST be identically encoded
regardless of the implementation.

In the case of symmetric algorithms, the associated parameters for the
OID MUST specify all of the parameters necessary to differentiate
between two instances of the same algorithm. For instance, the number
of rounds and block size for RC5 must be specified in addition to the
key length.

There is a list of OIDs (the registered SMIMECapabilities list) that
is centrally maintained and is separate from this draft. Upon moving
this draft to standards track, the IANA will maintain the list of
OIDs. Until this draft becomes a draft standard, the list of OIDs is
maintained by the Internet Mail Consortium at
<http://www.imc.org/ietf-smime/oids.html>.

The OIDs that correspond to algorithms SHOULD use the same OID as the
actual algorithm, except in the case where the algorithm usage is
ambiguous from the OID. For instance, in an earlier draft,
rsaEncryption was ambiguous because it could refer to either a
signature algorithm or a key encipherment algorithm. In the event that
an OID is ambiguous, it MUST be arbitrated by the maintainer of the
registered SMIMECapabilities list as to which type of algorithm will
use the OID, and a new OID MUST be allocated under the
SMIMECapabilities OID to satisfy the other use of the OID.

The registered SMIMECapabilities list specifies the parameters for
OIDs that need them, most notably key lengths in the case of
variable-length symmetric ciphers. In the event that there are no
differentiating parameters for a particular OID, the parameters MUST
be omitted, and MUST NOT be encoded as NULL.

Additional values for the SMIMECapabilities attribute may be defined
in the future. Also, additional attributes and values for those
attributes may be defined in the future. Receiving agents MUST handle
a SMIMECapabilities object that has attributes or values that it does
not recognize in a graceful manner.

2.6 ContentEncryptionAlgorithmIdentifier

S/MIME has two profiles for encryption: "restricted" and
"unrestricted". The difference between these profiles historically
came about due to US Government export regulations, as described at
the end of this section. It is expected that in the future, there will
be few agents that only use the restricted profile.

It is important to note that many current implementations of S/MIME
use the restricted profile described here. Any agent wishing to
interoperate by sending encrypted messages to, or receiving encrypted
messages from, current S/MIME agents MUST follow all the requirements
in section 2.6.2. It is also important to note that the difference
between restricted and unrestricted profile is limited to Section 2.6
and its subsections, and Section 6.1 and its subsections.

2.6.1 Restricted Profile

Receiving agents using the restricted profile MUST support decryption
using RC2 in CBC mode at a key size of 40 bits.

Sending agents using the restricted profile MUST support encryption
using RC2 in CBC mode at a key size of 40 bits.

Note that previous specifications for S/MIME allowed receiving or
sending agents using the restricted profile to use longer key lengths.
However, this was not widely implemented and only supported by private
agreement between the sending and receiving parties. Thus, receiving
and sending agents using the restricted profile SHOULD NOT use any key
length other than 40 bits.

2.6.2 Unrestricted Profile

Receiving agents using the unrestricted profile MUST support
decryption using:

DES EDE3 CBC
RC2 CBC, key size 40 bits
RC2 CBC, key size 64 bits
RC2 CBC, key size 128 bits

Receiving agents using the unrestricted profile SHOULD also support
decryption using:

DES CBC
RC5 CBC Pad (64 bit blocks, 16 rounds), key size 40 bits
RC5 CBC Pad (64 bit blocks, 16 rounds), key size 64 bits
RC5 CBC Pad (64 bit blocks, 16 rounds), key size 128 bits

Sending agents using the unrestricted profile MUST support encryption
using DES EDE3 CBC and RC2 CBC at a key size of 40 bits.

Sending agents using the unrestricted profile SHOULD also support
encryption using:

DES CBC
RC5 CBC Pad (64 bit blocks, 16 rounds), key size 40 bits
RC5 CBC Pad (64 bit blocks, 16 rounds), key size 64 bits
RC5 CBC Pad (64 bit blocks, 16 rounds), key size 128 bits
RC2 CBC, key size 64 bits
RC2 CBC, key size 128 bits

2.6.3 Deciding Which Encryption Method To Use

When a sending agent creates an encrypted message, it has to decide
which type of encryption to use. As stated in Section 2.6.1, a sending
agent using the restricted profile MUST support encrypting using RC2
in CBC mode at a key size of 40 bits and SHOULD use this type of
encryption. A sending agent using the unrestricted profile has to make
a more complicated decision.

Section 2.5 defines a method by which a sending agent using either
profile can optionally announce its decrypting capabilities in its
order of preference. The following method for processing and
remembering the encryption capabilities attribute in incoming signed
messages SHOULD be used.

 - If the receiving agent has not yet created list of capabilities for
   the sender's public key, then, after verifying the signature on
   the incoming message, the receiving agent should create a new list
   containing the signing- time and the symmetric-capabilities
   attributes.

 - If such a list already exists, the receiving agent SHOULD verify
   that the signing-time in the incoming message is greater than
   the signing time stored in the list. If so, it should update
   both the signing-time and symmetric-capabilities of the list.
   Values of signing-time that lie far in the future (that is, a
   greater discrepancy than any reasonable clock skew) SHOULD be
   rejected.

The list of encryption capabilities SHOULD be stored for future use in
creating messages.

The Sections 2.6.3.1 through 2.6.3.4 describe the order a sending
agent using the unrestricted profile SHOULD use in deciding which type
of encryption should be applied to a message.

2.6.3.1 Known Capabilities

If a sending agent using the unrestricted profile has received a set
of capabilities from the intended recipient for the message the agent
is about to encrypt, the agent SHOULD use that information by
selecting the first capability in the list (that is, the capability
most preferred by the intended recipient) for which sending agent
knows how to encrypt. The sending agent SHOULD use one of the
capabilities in the list if it reasonably expects the recipient to be
able to decrypt the message.

2.6.3.2 Unknown Capabilities, Willing To Risk Failed Decryption

If a sending agent using the unrestricted profile has no knowledge of
the encryption capabilities or profile of a recipient, and the sending
agent has not received any message from the recipient, and the sending
agent is willing to risk that the recipient may not be able to decrypt
the message because the recipient agent is using the restricted
profile, the sending agent SHOULD use DES EDE3 CBC. Although this may
lead to occasional failed decryption, using a strong encryption
algorithm with a long key is more secure than always defaulting to a
weaker algorithm and key size.

2.6.3.3 Unknown Capabilities, Known Use of Restricted Profile

If a sending agent using the unrestricted profile has not received a
set of capabilities from the intended recipient for the message, but
the sending agent has received at least one message from the
recipient, and the last message received used RC2 in CBC mode at a key
size of 40 bits (indicating that the recipient only uses the
restricted profile), the outgoing message SHOULD use RC2 in CBC mode
at a key size of 40 bits if the sending agent reasonably expects the
recipient to be able to decrypt the message.

2.6.3.4 Unknown Capabilities, Unwilling To Risk Failed Decryption

If a sending agent using the unrestricted profile has no knowledge of
the encryption capabilities of a recipient, and the sending agent is
not willing to risk that the recipient may not be able to decrypt the
message, the sending agent MUST use RC2 in CBC mode with a key size 40
bits, even though this is known to be a short key size that is
suseptable to an exhaustive key search. Implementors creating sending
agent SHOULD allow a human sender to determine the consequences of a
recipient not being able to decrypt a message so that the sender can
choose to use stronger encryption.

2.6.4 Historical Reasons for the Existence of Two Encryption Profiles

Due to US Government export regulations, an S/MIME agent which
supports a strong content encryption algorithm such as DES would not
be freely exportable outside of North America. US software
manufacturers have been compelled to incorporate an exportable or
"restricted" content encryption algorithm in order to create a widely
exportable version of their product. S/MIME agents created in the US
and intended for US domestic use (or use under special State
Department export licenses) can utilize stronger, "unrestricted"
content encryption. However, in order to achieve interoperability,
such agents MUST support whatever exportable algorithm is incorporated
in restricted S/MIME agents.

The RC2 symmetric encryption algorithm has been approved by the US
Government for "expedited" export licensing at certain key sizes.
Consequently, support for the RC2 algorithm in CBC mode is required
for baseline interoperability in all S/MIME implementations. Support
for other strong symmetric encryption algorithms such as RC5 CBC, DES
CBC and DES EDE3-CBC for content encryption is strongly encouraged
where possible.

3. Creating S/MIME Messages

This section describes how to create S/MIME messages using various
body parts, some of which are cryptographically processed as described
in Section 2. The reader of this section is expected to understand
MIME as described in [MIME-SPEC] and [MIME-SECURE].

3.1 Content-Type application/pkcs7-mime

This subsection defines the format of data used in
application/pkcs7-mime.

3.1.1 Format of the application/pkcs7-mime Body

PKCS #7 defines a general ASN.1 type, ContentInfo, for use in
exchanging cryptographic information. PKCS #7 also defines several
content types which can be used within a ContentInfo. For our purposes
here, the most important are SignedData (for exchanging digitally
signed data), EnvelopedData (for exchanging digitally enveloped data)
and SignedAndEnvelopedData (for exchanging data both digitally signed
and enveloped).

Therefore, when the MIME content type application/pkcs7-mime is used,
the body MUST be a ContentInfo as defined by [PKCS-7], encoded using
the Basic Encoding Rules (BER). The PKCS #7 content type SHOULD be
SignedData, EnvelopedData or SignedAndEnvelopedData, but use of other
content types defined by [PKCS-7] are also allowed.

Since BER is specified, instead of the more restrictive DER, an
application may use techniques such as indefinite-length encoding.
This is especially useful for transferring large data or streamed data
where the total length is not known in advance.

Data produced by BER is 8-bit, but many transports are limited to
7-bit data. Therefore, in most situations, a suitable 7-bit
Content-Transfer-Encoding is needed, such as base64.

PKCS #7 has a provision for "detached data", where, for example, the
SignedData in the ContentInfo contains only the signature information,
but not the actual data which is signed (which is transferred
separately). S/MIME agents using application/pkcs7-mime MUST NOT use
detached data, and the data MUST be present within the ContentInfo.

PKCS #7 provides for a degenerate case of SignedData which can be used
for disseminating certificates and CRLs. This is explicitly allowed in
application/pkcs7-mime. In this case, the content is omitted from the
ContentInfo and there are no entries in the SignerInfos, leaving only
entries for certificates and CRLs. Typically, this is used to convey
certificates in response to a certification request, or CRLs in
response to a CRL retrieval request. The MIME agent SHOULD process and
store the certificates and CRLs and may choose to display a
confirmation to the user.

The requirement that the signed or enveloped data has to itself be a
MIME body part is the reason the protocol defined here is called
"application/pkcs7-mime" and not "application/pkcs7". A protocol for
transferring a PKCS #7 object with arbitrary signed or enveloped
content could be defined, but is outside the scope of this draft.

3.1.2 Format of the Signed or Enveloped application/pkcs7-mime Data

PKCS #7 places no requirements on the format of the data which is
signed or enveloped. However, for use in application/pkcs7-mime, the
signed or enveloped data is itself a MIME entity. Therefore, when a
MIME agent receives an application/pkcs7-mime object, the result of
removing the signature or envelope can be passed directly to the
normal MIME-processing software.

Because the MIME entity being signed or enveloped is likely to be
transferred to and processed on a different platform than it was
created, the data MUST be in MIME canonical format.

The most common difference between platforms is the end of line
delimiter. There are other considerations for the selection of the
transfer encoding for the MIME entity that affect the ability to
verify the signature of a received MIME entity, especially if it is to
be subsequently forwarded. The data that is signed or enveloped has to
be recovered by the recipient in the exact form it was produced by the
sender, so agents MUST be sure that this data be in a canonical format
which can be processed by any platform. Converting a message into
canonical format is covered in [MIME-SPEC].

When creating a full MIME entity, the encoded sub-entities are
inserted in the full MIME entity. This step consists essentially of
concatenating the sub-entities interspersed with the appropriate MIME
Content-type, Content-Transfer-Encoding, and related headers and part
boundaries. Note that MIME headers and boundaries are all text with
canonical line endings.

3.1.3 Outside Content Transfer Encoding

The body of application/pkcs7-mime is a BER-encoded PKCS #7
ContentInfo. However, as mentioned above, the result of BER-encoding
is binary data, not 7-bit text. If S/MIME is being used in a system
that requires 7-bit text, such as SMTP, a content transfer encoding
must be used. In general, base64 Content-Transfer-Encoding can be
used, although all that is required is that the transfer encoding be
such that application/pkcs7-mime entity can be transferred intact. (It
is even possible that the transfer encoding will be changed by the
message transfer agent, because this is explicitly permitted.)

3.1.4 Receiving an application/pkcs7-mime Body Part

These are the steps for receiving an application/pkcs7-mime message.

Step 1. Remove any content transfer encoding.

Step 2. Examine the PKCS #7 ContentInfo to determine the PKCS #7
content type.

Step 3. Process the inner content type according to PKCS #7.

Step 4. Pass the result to a standard MIME processor which removes
transfer encoding, splits multipart entities, and possibly converts
the parts to local format.

3.2 Content-Type application/pkcs10

A typical application which allows a user to generate cryptographic
information has to submit that information to a certification
authority, who transforms it into a certificate. PKCS #10 describes a
syntax for certification requests. The application/pkcs10  body type
MUST be used to transfer a PKCS #10 certification request.

The details of certification requests and the process of obtaining a
certificate are beyond the scope of this draft. Instead, only the
format of data used in application/pkcs10 is defined.

3.2.1 Format of the application/pkcs10 Body

PKCS #10 defines the ASN.1 type CertificationRequest for use in
submitting a certification request. Therefore, when the MIME content
type application/pkcs10 is used, the body MUST be a
CertificationRequest, encoded using the Basic Encoding Rules (BER).

Although BER is specified, instead of the more restrictive DER, a
typical application will use DER since the CertificationRequest's
CertificationRequestInfo has to be DER-encoded in order to be signed.
A robust application SHOULD output DER, but allow BER or DER on input.

Data produced by BER or DER is 8-bit, but many transports are limited
to 7-bit data. Therefore, a suitable 7-bit Content-Transfer-Encoding
SHOULD be applied. The base64 Content-Transfer-Encoding SHOULD be used
with application/pkcs10, although any 7-bit transfer encoding may
work.

3.2.2 Sending and Receiving an application/pkcs10 Body Part

For sending a certificate-signing request, the application/pkcs10
message format MUST be used to convey a PKCS #10 certificate-signing
request. Note that for sending a certificates and CRLs messages
without any signed content, the application/pkcs7-mime message format
MUST be used to convey a degenerate PKCS #7 signedData "certs-only"
message.

To send an application/pkcs10 body, the application generates the
cryptographic information for the user. The details of the
cryptographic information are beyond the scope of this draft.

Step 1. The cryptographic information is placed within a PKCS #10
CertificationRequest.

Step 2. The CertificationRequest is encoded according to BER or DER
(typically, DER).

Step 3. As a typical step, the DER-encoded CertificationRequest is
also base64 encoded so that it is 7-bit data suitable for transfer in
SMTP. This then becomes the body of an application/pkcs10 body part.

The result might look like this:

     Content-Type: application/pkcs10
     Content-Transfer-Encoding: base64

     rfvbnj756tbBghyHhHUujhJhjH77n8HHGT9HG4VQpfyF467GhIGfHfYT6
     7n8HHGghyHhHUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H
     f8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
     0GhIGfHfQbnj756YT64V

A typical application only needs to send a certification request. It
is a certification authority that has to receive and process the
request. The steps for recovering the CertificationRequest from the
message are straightforward but are not presented here. The procedures
for processing the certification request are beyond the scope of this
document.

3.3 Use of the Multipart/Signed Content-Type

[MIME-SECURE] defines the multipart/signed content type explicitly for
clear-signed messages. Clear signing means the content is in the clear
so that recipients with systems that do not process PKCS information
can still read the message even if they cannot verify the signature.
The multipart/signed MIME type is a multipart type with exactly two
parts. The first part carries the MIME entity being signed, and the
second part carries the signature.

The multipart/signed Content type has two parameters: - The protocol
parameter (required) - The micalg parameter (optional)

The protocol parameter MUST be "application/pkcs7-signature". Note
that quotation marks are required around the protocol parameter
because MIME requires that the "/" character in the parameter value
MUST be quoted.

The optional micalg parameter allows for one-pass processing when the
signature is being verified. The value of the micalg parameter is
dependent on the message digest algorithm used in the calculation of
the Message Integrity Check.

An example of a multipart/signed message is:

       Content-Type: multipart/signed;
          protocol="application/pkcs7-signature";
          micalg=rsa-md5; boundary=boundary42

       --boundary42
       Content-Type: text/plain

       This is a clear-signed message
       --boundary42
       Content-Type: application/pkcs7-signature
       Content-Transfer-Encoding: base64

       ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfHfYT6
       4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbB9HGTrfvbnj
       n8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4
       7GhIGfHfYT64VQbnj756
       --boundary42--

3.3.1 Preparation of the Data for Signing

The data is prepared as described in section 3.2 with the following
extra considerations for transfer encoding. All parts of the MIME
entity MUST be encoded with 7-bit, quoted-printable, or base64
transfer encoding before computing the signature. No binary or 8-bit
data is permitted. This means that receiving agents, even those on
8-bit-clean transport systems, MUST be able to remove 7-bit,
quoted-printable, or base64 transfer encoding.

The current Internet mail transport infrastructure cannot guarantee
transport of unencoded binary or 8-bit data and because the digest for
the signature is computed on the fully encoded message. If a message
with 8-bit data were to encounter a  message transfer agent (MTA) that
can not transmit 8-bit or binary data it has three options, none of
which are acceptable for a clear-signed message.
 - The MTA could change the transfer encoding, but that would
   invalidate the signature.
 - The MTA could transmit the data anyway, which would most likely
   result in the 8th bit being stripped, also resulting in the
   signature being invalidated.
 - The MTA could return the message to the sender.

[MIME-SECURE] prohibits an MTA from changing the transfer encoding of
the first part of a multipart/signed message. If a compliant MTA
encountered a multipart/signed message with 8-bit or binary data in
the first part, it would have to return the message to the sender as
undeliverable.

Sending agents may choose to use quoted printable transfer encoding in
some situations where it may not otherwise seem necessary to better
preserve the data so the signature can be verified. For example,
trailing spaces should always be quoted-printable encoded because some
mail systems strip them if they are not transferred with encoding.
Also the word "From" followed by a space at the beginning of a line
should be encoded as some mail systems convert this to ">From".
Because of the restriction on 8-bit transport it is also necessary to
use quoted printable encoding for text using an 8-bit character set
such as ISO-8859-1.

3.3.2 The application/pkcs7-signature Type

The second part of the multipart/signed message MUST be type
application/pkcs7-signature. The data in the second part is the PKCS
#7 detached signature. A detached signature is a PKCS #7 data object
of type SignedData with the signerInfos field containing signatures on
some external data and the ContentInfo field empty. In this case, the
external data is the fully encoded MIME entity described above and
placed in the first part of the multipart/signed message.

3.3.3 Procedure for Sending a Clear Signed Message

Step 1. The data is prepared as described above so the transfer
encoding of all the parts is either 7-bit, quoted-printable or base64.

Step 2. The PKCS #7 detached signature for the data is computed.

Step 3. The content data is inserted into the first part of the
multipart/signed MIME entity.

Step 4. The detached signature is inserted into the second part of the
multipart/signed message using appropriate transfer encoding.

3.3.4 Procedure for Receiving a Clear Signed Message

Step 1. The agent separates the two parts of the multipart/signed
entity.

Step 2. The message digest of the first part of the multipart/signed
message is computed.

Step 3. The application/pkcs7-signature information in the second part
is processed along with the digest obtained in the first step to
verify the signature.

Step 4. The MIME processing and decoding of the first part proceeds
and the message is presented to the user along with the result of the
signature verification.

3.4 Nesting of S/MIME Security Services

MIME allows for an arbitrarily complex structure that is frequently
limited in practice to a basic functional subset. While the MIME
specification allows an arbitrary depth of MIME entities nested within
other MIME entities, the addition of security services to a MIME
message makes arbitrary nesting difficult to implement and challenging
to convey to a user in a meaningful way. As with other areas in the
S/MIME specification, requirements and recommendations are made which
attempt to balance the concerns of utility versus simplicity.

If a user chooses to both sign and envelope a message to another user,
this can be accomplished in two ways:
 - by creating a PKCS #7 signedAndEnvelopedData content type
 - by separately creating a signedData content type then using the
   result as input to create an envelopedData content type

Concerns have been voiced about the fact that the
signedAndEnvelopedData content type exposes the identities of the
S/MIME signatories (i.e. the issuerAndSerialNumber for each signatory
is not protected in the envelope).

In order to accommodate the protection of signatory information within
enveloped messages all sending and receiving agents MUST support the
nesting of signed messages within enveloped messages. If an incoming
enveloped message is decrypted and the resulting MIME entity is a
signed application/pkcs7-mime, then the user agent SHOULD
automatically process the resulting MIME entity and present the
signature status and corresponding information to the user.

Likewise, if a user chooses to sign and encrypt an outgoing message,
then the user agent SHOULD automatically create an
application/pkcs7-mime signed message then use the resulting message
as input to the creation of an application/pkcs7-mime enveloped
message. In the case of this signed/enveloped nesting, the inner
signed message SHOULD be left in its binary state and that the content
transfer encoding on the inner signed message be indicated as binary.

There are a number of useful security functions that can be achieved
by allowing additional nesting of security services. An receiving
agent SHOULD allow for automatic processing of one or two additional
layers of S/MIME entities nested in other S/MIME entities. Where
additional nesting is not automatically handled, some provision SHOULD
be made to handle additional nesting manually, such as through some
explicit user action such as the resubmission of the resulting message
to the user agent.

3.5 Choosing the Message Type for Outgoing Signed Messages

There are two distinct mechanisms for conveying a signed message:

 - a signed, self-contained application/pkcs7-mime construct
 - a multipart/signed construct (where the signature is conveyed
   separate from the signed data in an application/pkcs7-signature
   body part)

Sending agents MUST support creation of both application/pkcs7-mime
and multipart/signed messages. Therefore, receiving agents MUST be
able to process signatures from both types of messages.

In many Internet mail transactions, there is a reasonable expectation
that MIME messages will be delivered intact. However, because of the
limitations inherent in a significant portion of existing mail
infrastructure, not all S/MIME-enabled agents will be able to
correctly receive and/or process multipart/signed messages. For
example, some older gateways and message transfer agents will treat
unknown multipart messages such as multipart/signed as multipart/mixed
and discard the MIME packaging for the signed message, leading to
unverifiable signatures.

One of the greatest values of the multipart/signed construct is in the
ability of agents which are not S/MIME-enabled to be able to handle
the (otherwise unencoded) body of the message that was signed. Thus,
multipart/signed SHOULD be used when a signed message is being sent to
a set of recipients where the S/MIME capabilities are not all known.

If the sending agent believes that a particular recipient might not be
able to receive a multipart/signed message successfully due to
improper gateways, the agent can either:
 - wrap the multipart/signed message in another MIME envelope using
   application/mime, as described in [MIME-APP]
 - use application/pkcs7-mime instead of multipart/signed

Both methods have advantages and drawbacks. Because of the newness of
the specification, few gateways would try to break open an
application/mime message, and this should thus shield the contents
fairly well. Further, because application/mime messages are plain
text, non-MIME recipients of such a message would still be able to
read it (albeit after visually parsing the message). However, because
of the newness of the specification, few of the currently-implemented
S/MIME receiving agents would know what to do with an application/mime
message. All receiving S/MIME agents do know how to interpret
application/pkcs7-mime messages, so using this scheme will lead to
good interpretation by S/MIME-aware agents. However the contents of an
application/pkcs7-mime message are indecipherable to non-S/MIME
receiving agents.

When all of the intended recipients are known to be S/MIME-capable,
the sending agent SHOULD use application/pkcs7-mime because it has a
greater possibility of successful receipt through unknown gateways.
The availability of certificates for all intended message recipients
and/or S/MIME-specific entries in an addressbook or database may be a
good indication that all recipients are S/MIME-capable.

3.5.1 Sending to Mailing Lists

Sending agents often send messages to recipients on public mailing
lists and systems outside traditional Internet mail like Usenet. As
stated earlier, one of the important benefits of multipart/signed
messages is that their text portions can be displayed (but not
verified) by non-S/MIME and by non-MIME recipients. If
application/pkcs7-mime is used instead of multipart/signed, the
message will only be readable by recipients with S/MIME tools.
Therefore, implementors of S/MIME agents SHOULD attempt to ensure that
application/pkcs7-mime messages are never sent to public forums which
have participation from non-S/MIME-enabled users.

If a sending agent cannot generate multipart/signed, and the user of
that agent wants to sign a message that is being sent to a recipient
who has not explicitly advertised support for application/pkcs7-mime,
then the sender SHOULD be warned that some users may not be able to
read the message at all if sent in signed form, and that they should
only proceed if they are confident that all recipients have S/MIME
capability.

Because you generally cannot know all the capabilities of all the
recipients of a mailing list or similar forum, the use of
application/pkcs7-mime SHOULD be strongly discouraged for messages
sent to these types of lists and, if allowed at all, appropriate
warnings SHOULD be issued.

3.5.2  Choice Matrix Summary

This chart describes when a sending agent SHOULD use each MIME type:

MIME Type                        When to Use

application/pkcs7-mime           When sending envelopedData

                                 When sending signedData to
                                 only S/MIME-capable recipients
                                 where multipart/signed is expected
                                 to not arrive intact

                                 When sending a certs-only
                                 message

multipart/signed                 Default for  sending a signed
                                 message; required when sending a
                                 signed message to a mix of
                                 recipients where S/MIME-
                                 capabilities are not known for
                                 all recipients

application/mime                 When sending multipart/signed to
                                 recipient who may or may not be
                                 S/MIME-capable and the message
                                 is expected to not arrive intact

application/pkcs10               When sending a certification
                                 request to a certification authority

3.6 Relationship to File-Based MIME Security

The use of S/MIME is not limited to the on-line mail environment. By
associating standard file extensions to the various S/MIME content
types, useful automatic conversion can occur between agents and
file-based S/MIME processing capabilities in a receiving agent or at
the operating system level. The MIME Content-Type header field has an
optional parameter, "name", that is useful for saving body parts on
disk at the recipient's site. The MIME Content-Disposition header
field, with the value "attachment" also has an optional parameter,
"filename", for saving body parts on disk at the recipient's site.

Sending agents SHOULD emit the optional name parameter to the
Content-Type field for the for compatibility with older systems.
Sending agents SHOULD emit the optional Content-Disposition field with
the filename parameter. If a sending agent emits a Content-Disposition
field with the filename parameter, it MUST use the file extensions
listed below that is consistent with the content type. Both of these
parameters SHOULD be set to the same filename with extension.

For support of legacy systems (i.e. DOS) the filename should be
limited to eight characters followed by a period followed by a three
letter extension. The eight character filename base can be any
distinct name; the use of the filename "smime" SHOULD be used to
indicate that the MIME entity is associated with S/MIME.

The filename extensions MUST correspond to the S/MIME message types
from this table:

S/MIME Type                     File Extension

application/pkcs7-signature         .p7s


application/pkcs7-mime              .p7m
(for signedData and
envelopedData)

application/pkcs7-mime              .p7c
(degenerate signedData
"certs-only" message)

application/pkcs10                  .p10

For instance:

Content-Type: application/pkcs7-mime;name="smime.p7m"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;filename="smime.p7m"

<base64 data goes here>

If this message were of type application/pkcs10, then the filename
would be something like "smime.p10".

If S/MIME constructs are saved to or imported from disk, the same file
extensions SHOULD be used. This allows for static registry of the
filename extension and a particular associated "helper" application in
certain application environments.

Certain older MIME agents and gateways automatically convert unknown
subtypes of the MIME "application" type to application/octet-stream.
Sending agents including the optional name parameter and the optional
Content-Disposition: attachment;filename= parameter give at least some
indication that the included MIME entity is an S/MIME entity. S/MIME
agents and "helper" applications SHOULD be capable of processing
application/octet-stream messages with recognized S/MIME filename
extensions either automatically or by explicit user action.

4. Certificate Processing

A receiving agent MUST provide some certificate retrieval mechanism in
order to gain access to certificates for recipients of digital
envelopes. This draft does not cover how S/MIME agents handle
certificates, only what they do after a certificate has been validated
or rejected. S/MIME certification issues are covered in a different
document.

At a minimum, for initial S/MIME deployment, a user agent could
automatically generate a message to an intended recipient requesting
that recipient's certificate in a signed return message. Receiving and
sending agents SHOULD also provide a mechanism to allow a user to
"store and protect" certificates for correspondents in such a way so
as to guarantee their later retrieval.

4.1 Key Pair Generation

An S/MIME agent or some related administrative utility or function MUST
be capable of generating RSA key pairs on behalf of the user. Each key
pair MUST be generated from a good source of non-deterministic
random input and protected in a secure fashion.

4.1.1 Restricted Profile

A restricted agent MUST generate 512 bit RSA key pairs for key
management. In many cases, the same RSA key pair is used both for key
management and signatures. Where there are mechanisms to support the
separation of keying material for signatures versus key management, a
restricted agents SHOULD generate and use RSA keys with key sizes from
768 bits to 1024 bits for signatures.

4.1.2 Unrestricted Profile

An unrestricted agent SHOULD generate RSA key pairs at a minimum key
size of 768 bits and a maximum key size of 1024 bits because this is
the largest key size which can be used by restricted S/MIME agents for
key management.

4.1.3 History of Restrictions

Due to US Government export regulations, an S/MIME agent which
supports the generation of large RSA key sizes for key management
would not be freely exportable outside of North America. US
software manufacturers have been compelled to limit the key sizes
of RSA keys generated for key management in order to create a
widely exportable "restricted" version of their product. S/MIME
agents intended for domestic use (or use under special State
Department export licenses) can generate larger key sizes.
However, in order to achieve the widest possible interoperability,
such agents SHOULD limit the size of generated keys to those
supported in restricted S/MIME agents.


Appendix A - Object Identifiers & Syntax

The syntax for SMIMECapability is:

SMIMECapability ::= SEQUENCE {
    capabilityID OBJECT IDENTIFIER,
    parameters OPTIONAL ANY DEFINED BY capabilityID }

SMIMECapabilities ::= SEQUENCE OF SMIMECapability

A.1 Content Encryption Algorithms

RC2-CBC OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 2}

For the effective-key-bits (key size) other than 32 and less than
256, the RC2-CBC algorithm parameters are encoded as:

RC2-CBC parameter ::=  SEQUENCE {
     rc2ParameterVersion  INTEGER,
     iv                   OCTET STRING (8)}

For the effective-key-bits of 40, 64, and 128, the
rc2ParameterVersion values are 160, 120, 58 respectively.

RC5-CBCPad OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 9}

RC5_CBC_PARAMETER ::= SEQUENCE {
     version           INTEGER (v1_0(16)),
     rounds            INTEGER (8..127),
     blockSizeInBits   INTEGER (64, 128),
     iv                OCTET STRING OPTIONAL}

For S/MIME, we use 16 rounds and a 64 bit block size.

DES-CBC OBJECT IDENTIFIER ::=
     {iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2) 7}

DES-EDE3-CBC OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 7}

For DES-CBC and DES-EDE3-CBC, the parameter should be encoded as:

CBCParameter :: IV

where IV ::= OCTET STRING -- 8 octets.

A.2 Digest Algorithms

md5 OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) digestAlgorithm(2) 5}

sha-1 OBJECT IDENTIFIER ::=
     {iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2) 26}

A.3 Asymmetric Encryption Algorithms

rsaEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 1}

rsa OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) algorithm(8) encryptionAlgorithm(1) 1}

A.3 Signature Algorithms

md2WithRSAEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 2}

md5WithRSAEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 4}

sha-1WithRSAEncryption OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5}

A.4 Signed Attributes

signingTime OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-9(9) 5}

B. References

[MIME-APP] "Wrapping MIME Objects:  Application/MIME", Internet
Draft draft-crocker-wrap-01.txt.

[MIME-SPEC] The primary definition of MIME. "MIME Part 1: Format of
Internet Message Bodies", RFC 2045; "MIME Part 2: Media Types", RFC
2046; "MIME Part 3: Message Header Extensions for Non-ASCII Text", RFC
2047; "MIME Part 4: Registration Procedures", RFC 2048; "MIME Part 5:
Conformance Criteria and Examples", RFC 2049

[MIME-SECURE] "Security Multiparts for MIME: Multipart/Signed and
Multipart/Encrypted", RFC 1847

[PEM] "Privacy-Enhanced Mail (PEM) basics", RFC 1421

[PKCS-1], "PKCS #1: RSA Encryption Standard", submission of draft
pending

[PKCS-7], "PKCS #7: Cryptographic Message Syntax Standard", submission
of draft pending

[PKCS-9], "PKCS #9: Selected Attribute Types", submission of draft
pending

[PKCS-10], "PKCS #10: Certification Request Syntax Standard",
submission of draft pending

C. Compatibility with Pre-standards S/MIME

S/MIME was originally developed by RSA Data Security, Inc. Many
developers implemented S/MIME agents before the standard was turned
over to the IETF. All S/MIME receiving agents SHOULD make every attempt to
interoperate with pre-standards S/MIME sending agents.

C.1 Pre-standards MIME Types

Pre-standard S/MIME agents used the following MIME types:

application/x-pkcs7-mime
application/x-pkcs7-signature
application/x-pkcs10

In each case, the "x-" subtypes correspond to the subtypes described
in this document without the "x-".

D. Revision History

This draft is a combination of an earlier draft,
draft-dusse-mime-msg-spec-00, which specified the format for S/MIME
messages, and the "S/MIME Implementation Guide, Interoperability
Profiles, Version 2", a document from RSA Data Security. This draft
includes changes to the wording, but not the intent, of both
documents. Part of the "Implementation Guide" document was split
out into a draft that describes S/MIME certification issues.

This draft supersedes draft-dusse-mime-msg-spec-00, which is now
expired.

E. Open Issues

Split out Section 3 as a stand-alone document. Also, add back
description of how to do content transfer encoding.

What to do if sending to multiple people with different known
capabilities? What if sending to a group, some of whom have
known capabilities, others with unknown?

Whether or not the PKCS-nn documents will be IETF RFCs or simply be
referenced as external documents.

References to the encryption and hash algorithms.

Use of the S/MIME trademark.

Include an appendix with the proper requests for new MIME subtypes.

Need to list text values for the micalg parameter of multipart/signed.
RFC 1848 lists only "RSA-MD2" and "RSA-MD5", not "SHA-1".

Need new wording for section 3.5's "improper gateways" discussion.
Need to make it clear that multipart/signed is always strongly
preferred.

Lawrence will reorder and rewrite all of section 3. No changes to
the spec, but will make it easier to implement from.

Should nesting be restricted like it is now?

Look at the use of PKCS-7 "data" format.

Should 8-bit text be allowed? Revisit binary MIME.

Look at canonicalization issues for signing

What does PEM compatibility mean/entail, and do we care?

Remove and/or deprecate signedAndEnveloped in the draft.

Make the micalg parameter required, not optional.

Do we need better heuristics for determining the encryption
capabilities of a recipient? What about guessing based on
key length?

Need to change the wording in Section 2.6.3 to indicate that
it is discussing all capabilities, not just encryption.

F.  Trademarks

RSA Data Security, Inc., owns the US trademark for the name "S/MIME"
and for a logo associated with that name. RSA Data Security, Inc., is
currently in discussions with the IETF about the use of the name
"S/MIME" for interoperable message security. The name "S/MIME" may or
may not be used in future versions of this draft.

G. Acknowledgements

Significant contributions to the content of this draft were made by
many people, including:
Jeff Thompson
Jeff Weinstein

H. Authors' addresses

Steve Dusse
RSA Data Security, Inc.
100 Marine Parkway, #500
Redwood City, CA  94065  USA
(415) 595-8782
spock@rsa.com

Paul Hoffman
Internet Mail Consortium
127 Segre Place
Santa Cruz, CA  95060
(408) 426-9827
phoffman@imc.org

Blake Ramsdell
Deming Internet Security
13122 NE 20th St., Suite C
Bellevue, WA 98005
(206) 882-8861
blaker@deming.com

Laurence Lundblade
QUALCOMM Incorporated
Eudora Division
6455 Lusk Boulevard
San Diego, California 92121-2779
(800) 238-3672
lgl@qualcomm.com

Lisa Repka
Netscape Communications Corporation
501 East Middlefield Road
Mountain View, CA  94043
(415) 254-1900
repka@netscape.com


Html markup produced by rfcmarkup 1.109, available from https://tools.ietf.org/tools/rfcmarkup/