Internet Draft Steve Dusse, draft-dusse-smime-msg-00.txt RSA Data Security March 25, 1997 Paul Hoffman, Expires September 25, 1997 Internet Mail Consortium Blake Ramsdell, Deming Internet Security Laurence Lundblade, Qualcomm Lisa Repka, Netscape S/MIME Message Specification Status of this memo This document is an Internet-Draft. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." To learn the current status of any Internet-Draft, please check the "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe), munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or ftp.isi.edu (US West Coast). 1. Introduction S/MIME (Secure/Multipurpose Internet Mail Extensions) provides a standard way to send and receive secure MIME messages. Based on the popular Internet MIME standard, S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity and non-repudiation of origin (using digital signatures) and privacy and data security (using encryption). S/MIME can be used by traditional mail user agents (MUAs) to add cryptographic security services to mail that is sent, and to interpret cryptographic security services in mail that is received. However, S/MIME is not restricted to mail; it can be used with any transport mechanism that transports MIME messages, such as HTTP. As such, S/MIME takes advantage of the object-based features of MIME and allows secure messages to be exchanged in mixed-transport systems. Further, S/MIME can be used in automated message transfer agents that use cryptographic security services that do not require any human intervention, such as the signing of software-generated documents and the encryption of FAX messages sent over the Internet. 1.1 Specification Overview This document describes a protocol for adding cryptographic signature and encryption services to Internet MIME messages. The MIME standard [MIME-SPEC] provides a general structure for the content type of Internet messages and allows extensions for new content type applications. This draft defines how to create a MIME body part has been cryptographically enhanced according to PKCS #7 [PKCS-7]. This draft also defines the application/pkcs7-mime MIME type that can used to transport those body parts. This draft also defines how to create certification requests that conform to PKCS #10 [PKCS-10], and the application/pkcs10 MIME type for transporting those request. This draft also discusses how to use the multipart/signed MIME type defined in [MIME-SECURE] to transport S/MIME signed messages. This draft also defines the application/pkcs7-signature MIME type, which is also used to transport S/MIME signed messages. This specification is compatible with PKCS #7 in that it uses the data types defined by PKCS #7. In order to create S/MIME messages, an agent has to follow specifications in this draft, as well as some of the specifications listed in the following pre-standards works: - "PKCS #1: RSA Encryption Standard", [PKCS-1]. - "PKCS #7: Cryptographic Message Syntax Standard", [PKCS-7] - "PKCS #9: Selected Attribute Types", [PKCS-9]. - "PKCS #10: Certification Request Syntax Standard", [PKCS-10]. Throughout this draft, there are requirements and recommendations made for how receiving agents handle incoming messages. There are separate requirements and recommendations for how sending agents create outgoing messages. In general, the best strategy is to "be liberal in what you receive and conservative in what you send". Most of the requirements are placed on the handling of incoming messages while the recommendations are mostly on the creation of outgoing messages. The separation for requirements on receiving agents and sending agents also derives from the likelihood that there will be S/MIME systems that involve software other than traditional Internet mail clients. S/MIME can be used with any system that transports MIME messages. An automated process that sends an encrypted message might not be able to receive an encrypted message at all, for example. Thus, the requirements and recommendations for the two types of agents are listed separately when appropriate. 1.3 Definitions For the purposes of this draft, the following definitions apply. ASN.1: Abstract Syntax Notation One, as defined in CCITT X.208. BER: Basic Encoding Rules for ASN.1, as defined in CCITT X.209. Certificate: A type that binds an entity's distinguished name to a public key with a digital signature. DER: Distinguished Encoding Rules for ASN.1, as defined in CCITT X.509, Section 8.7. 7-bit data: Text data with lines less than 998 characters long, where none of the characters have the 8th bit set, and there are no NULL characters. <CR> and <LF> occur only as part of a <CR><LF> end of line delimiter. 8-bit data: Text data with lines less than 998 characters, and where none of the characters are NULL characters. <CR> and <LF> occur only as part of a <CR><LF> end of line delimiter. Binary data: Arbitrary data. Transfer Encoding: A reversible transformation made on data so 8-bit or binary data may be sent via a channel that only transmits 7-bit data. 1.4 Compatibility with Pre-standards S/MIME Appendix C contains importnat information about how standards-based S/MIME agents should act in order to have the greatest interoperability with pre-standards S/MIME. 2. PKCS #7 Options The PKCS #7 message format allows for a wide variety of options in content and algorithm support. This section puts forth a number of support requirements and recommendations in order to achieve a base level of interoperability among all S/MIME implementations. 2.1 DigestAlgorithmIdentifier Receiving agents MUST support SHA-1 and MD5. Sending agents SHOULD use SHA-1. 2.2 DigestEncryptionAlgorithmIdentifier Receiving agents MUST support rsaEncryption, defined in [PKCS-1]. Receiving agents MUST support verification of signatures using RSA public key sizes from 512 bits to 1024 bits. Sending agents MUST support rsaEncryption. Outgoing messages are signed with a user's private key. The size of the private key is determined during key generation. 2.3 KeyEncryptionAlgorithmIdentifier Receiving agents MUST support rsaEncryption. Incoming encrypted messages contain symmetric keys which are to be decrypted with a user's private key. The size of the private key is determined during key generation. Sending agents MUST support rsaEncryption. Sending agents MUST support encryption of symmetric keys with RSA public keys at key sizes from 512 bits to 1024 bits. 2.4 General Syntax The PKCS #7 defines six distinct content types: "data", "signedData", "envelopedData", "signedAndEnvelopedData", "digestedData", and "encryptedData". Receiving agents MUST support the "data", "signedData", "signedAndEnvelopedData", and "envelopedData" content types. Sending agents may or may not send out any of the content types, depending on the services that the agent supports. 2.4.1 Data Content Type Sending agents MUST use the "data" content type as the content within other content types to indicate the MIME message content which has had security services applied to it. 2.4.2 Signed-data Content Type Sending agents MUST use the Signed-data content type to apply a digital signature to a MIME message or, in a degenerate case where there is no signature information, to convey information pertaining to certificates. 2.4.3 Enveloped-data Content Type This content type is used to apply privacy protection to a MIME message. A sender MUST have access to a public key for each intended message recipient to use this service. This content type does not provide authentication. 2.4.4 Signed-and-enveloped-data Content Type This content type is used to apply a digital signature as well as privacy protection to a MIME message. A sender MUST have access to a public key for each intended message recipient to use this service. This content type should only be used for compatibility with [PEM]. The separate application of signing then enveloping SHOULD be used in all other cases. 2.5 SignerInfo Type The SignerInfo type allows the inclusion of unauthenticated and authenticated attributes to be included along with a signature. Receiving agents MUST be able to handle and display zero or one instance of each of the signed attributes described in this section. Sending agents SHOULD be able to generate one instance of each of the signed attributes described in this section. 2.5.1 Signing-Time Attribute The signing-time attribute is used to convey the time that a message was signed. Until there are trusted timestamping services, the time of signing will most likely be created by a message originator and therefore is only as trustworthy as the originator. The syntax of the signing-time attribute is defined in [PKCS-9]. 2.5.2 SMIMECapabilities Attribute The SMIMECapabilities attribute includes signature algorithms (such as "md5WithRSAEncryption"), symmetric algorithms (such as "DES-CBC"), and key encipherment algorithms (such as "rsaEncryption"). It also currently includes a non-algorithm capability which is the preference for signedData. The SMIMECapabilities were designed to be flexible and extensible so that, in the future, a means of identifying other capabilities and preferences such as certificates can be added in a way that will not cause current clients to break. The semantics of the SMIMECapabilites attribute specify a partial list as to what the client announcing the SMIMECapabilites can support. A client does not have to list every capability it supports, and probably should not list all its capabilities so that the capabilities list doesn't get too long. In an SMIMECapabilities attribute, the OIDs are listed in order of their preference, but SHOULD be logically separated along the lines of their categories (signature algorithms, symmetric algorithms, key encipherment algorithms, etc.) The structure of the SMIMECapabilities attribute is to facilitate simple table lookups and binary comparisons in order to determine matches. For instance, the DER-encoding for the SMIMECapability for RC2-CBC with a 40-bit key length MUST be identically encoded regardless of the implementation. In the case of symmetric algorithms, the associated parameters for the OID MUST specify all of the parameters necessary to differentiate between two instances of the same algorithm. For instance, the number of rounds and block size for RC5 must be specified in addition to the key length. There is a list of OIDs (the registered SMIMECapabilities list) that is centrally maintained and is separate from this draft. Upon moving this draft to standards track, the IANA will maintain the list of OIDs. Until this draft becomes a draft standard, the list of OIDs is maintained by the Internet Mail Consortium at <http://www.imc.org/ietf-smime/oids.html>. The OIDs that correspond to algorithms SHOULD use the same OID as the actual algorithm, except in the case where the algorithm usage is ambiguous from the OID. For instance, in an earlier draft, rsaEncryption was ambiguous because it could refer to either a signature algorithm or a key encipherment algorithm. In the event that an OID is ambiguous, it MUST be arbitrated by the maintainer of the registered SMIMECapabilities list as to which type of algorithm will use the OID, and a new OID MUST be allocated under the SMIMECapabilities OID to satisfy the other use of the OID. The registered SMIMECapabilities list specifies the parameters for OIDs that need them, most notably key lengths in the case of variable-length symmetric ciphers. In the event that there are no differentiating parameters for a particular OID, the parameters MUST be omitted, and MUST NOT be encoded as NULL. Additional values for the SMIMECapabilities attribute may be defined in the future. Also, additional attributes and values for those attributes may be defined in the future. Receiving agents MUST handle a SMIMECapabilities object that has attributes or values that it does not recognize in a graceful manner. 2.6 ContentEncryptionAlgorithmIdentifier S/MIME has two profiles for encryption: "restricted" and "unrestricted". The difference between these profiles historically came about due to US Government export regulations, as described at the end of this section. It is expected that in the future, there will be few agents that only use the restricted profile. It is important to note that many current implementations of S/MIME use the restricted profile described here. Any agent wishing to interoperate by sending encrypted messages to, or receiving encrypted messages from, current S/MIME agents MUST follow all the requirements in section 2.6.2. It is also important to note that the difference between restricted and unrestricted profile is limited to Section 2.6 and its subsections, and Section 6.1 and its subsections. 2.6.1 Restricted Profile Receiving agents using the restricted profile MUST support decryption using RC2 in CBC mode at a key size of 40 bits. Sending agents using the restricted profile MUST support encryption using RC2 in CBC mode at a key size of 40 bits. Note that previous specifications for S/MIME allowed receiving or sending agents using the restricted profile to use longer key lengths. However, this was not widely implemented and only supported by private agreement between the sending and receiving parties. Thus, receiving and sending agents using the restricted profile SHOULD NOT use any key length other than 40 bits. 2.6.2 Unrestricted Profile Receiving agents using the unrestricted profile MUST support decryption using: DES EDE3 CBC RC2 CBC, key size 40 bits RC2 CBC, key size 64 bits RC2 CBC, key size 128 bits Receiving agents using the unrestricted profile SHOULD also support decryption using: DES CBC RC5 CBC Pad (64 bit blocks, 16 rounds), key size 40 bits RC5 CBC Pad (64 bit blocks, 16 rounds), key size 64 bits RC5 CBC Pad (64 bit blocks, 16 rounds), key size 128 bits Sending agents using the unrestricted profile MUST support encryption using DES EDE3 CBC and RC2 CBC at a key size of 40 bits. Sending agents using the unrestricted profile SHOULD also support encryption using: DES CBC RC5 CBC Pad (64 bit blocks, 16 rounds), key size 40 bits RC5 CBC Pad (64 bit blocks, 16 rounds), key size 64 bits RC5 CBC Pad (64 bit blocks, 16 rounds), key size 128 bits RC2 CBC, key size 64 bits RC2 CBC, key size 128 bits 2.6.3 Deciding Which Encryption Method To Use When a sending agent creates an encrypted message, it has to decide which type of encryption to use. As stated in Section 2.6.1, a sending agent using the restricted profile MUST support encrypting using RC2 in CBC mode at a key size of 40 bits and SHOULD use this type of encryption. A sending agent using the unrestricted profile has to make a more complicated decision. Section 2.5 defines a method by which a sending agent using either profile can optionally announce its decrypting capabilities in its order of preference. The following method for processing and remembering the encryption capabilities attribute in incoming signed messages SHOULD be used. - If the receiving agent has not yet created list of capabilities for the sender's public key, then, after verifying the signature on the incoming message, the receiving agent should create a new list containing the signing- time and the symmetric-capabilities attributes. - If such a list already exists, the receiving agent SHOULD verify that the signing-time in the incoming message is greater than the signing time stored in the list. If so, it should update both the signing-time and symmetric-capabilities of the list. Values of signing-time that lie far in the future (that is, a greater discrepancy than any reasonable clock skew) SHOULD be rejected. The list of encryption capabilities SHOULD be stored for future use in creating messages. The Sections 2.6.3.1 through 2.6.3.4 describe the order a sending agent using the unrestricted profile SHOULD use in deciding which type of encryption should be applied to a message. 2.6.3.1 Known Capabilities If a sending agent using the unrestricted profile has received a set of capabilities from the intended recipient for the message the agent is about to encrypt, the agent SHOULD use that information by selecting the first capability in the list (that is, the capability most preferred by the intended recipient) for which sending agent knows how to encrypt. The sending agent SHOULD use one of the capabilities in the list if it reasonably expects the recipient to be able to decrypt the message. 2.6.3.2 Unknown Capabilities, Willing To Risk Failed Decryption If a sending agent using the unrestricted profile has no knowledge of the encryption capabilities or profile of a recipient, and the sending agent has not received any message from the recipient, and the sending agent is willing to risk that the recipient may not be able to decrypt the message because the recipient agent is using the restricted profile, the sending agent SHOULD use DES EDE3 CBC. Although this may lead to occasional failed decryption, using a strong encryption algorithm with a long key is more secure than always defaulting to a weaker algorithm and key size. 2.6.3.3 Unknown Capabilities, Known Use of Restricted Profile If a sending agent using the unrestricted profile has not received a set of capabilities from the intended recipient for the message, but the sending agent has received at least one message from the recipient, and the last message received used RC2 in CBC mode at a key size of 40 bits (indicating that the recipient only uses the restricted profile), the outgoing message SHOULD use RC2 in CBC mode at a key size of 40 bits if the sending agent reasonably expects the recipient to be able to decrypt the message. 2.6.3.4 Unknown Capabilities, Unwilling To Risk Failed Decryption If a sending agent using the unrestricted profile has no knowledge of the encryption capabilities of a recipient, and the sending agent is not willing to risk that the recipient may not be able to decrypt the message, the sending agent MUST use RC2 in CBC mode with a key size 40 bits, even though this is known to be a short key size that is suseptable to an exhaustive key search. Implementors creating sending agent SHOULD allow a human sender to determine the consequences of a recipient not being able to decrypt a message so that the sender can choose to use stronger encryption. 2.6.4 Historical Reasons for the Existence of Two Encryption Profiles Due to US Government export regulations, an S/MIME agent which supports a strong content encryption algorithm such as DES would not be freely exportable outside of North America. US software manufacturers have been compelled to incorporate an exportable or "restricted" content encryption algorithm in order to create a widely exportable version of their product. S/MIME agents created in the US and intended for US domestic use (or use under special State Department export licenses) can utilize stronger, "unrestricted" content encryption. However, in order to achieve interoperability, such agents MUST support whatever exportable algorithm is incorporated in restricted S/MIME agents. The RC2 symmetric encryption algorithm has been approved by the US Government for "expedited" export licensing at certain key sizes. Consequently, support for the RC2 algorithm in CBC mode is required for baseline interoperability in all S/MIME implementations. Support for other strong symmetric encryption algorithms such as RC5 CBC, DES CBC and DES EDE3-CBC for content encryption is strongly encouraged where possible. 3. Creating S/MIME Messages This section describes how to create S/MIME messages using various body parts, some of which are cryptographically processed as described in Section 2. The reader of this section is expected to understand MIME as described in [MIME-SPEC] and [MIME-SECURE]. 3.1 Content-Type application/pkcs7-mime This subsection defines the format of data used in application/pkcs7-mime. 3.1.1 Format of the application/pkcs7-mime Body PKCS #7 defines a general ASN.1 type, ContentInfo, for use in exchanging cryptographic information. PKCS #7 also defines several content types which can be used within a ContentInfo. For our purposes here, the most important are SignedData (for exchanging digitally signed data), EnvelopedData (for exchanging digitally enveloped data) and SignedAndEnvelopedData (for exchanging data both digitally signed and enveloped). Therefore, when the MIME content type application/pkcs7-mime is used, the body MUST be a ContentInfo as defined by [PKCS-7], encoded using the Basic Encoding Rules (BER). The PKCS #7 content type SHOULD be SignedData, EnvelopedData or SignedAndEnvelopedData, but use of other content types defined by [PKCS-7] are also allowed. Since BER is specified, instead of the more restrictive DER, an application may use techniques such as indefinite-length encoding. This is especially useful for transferring large data or streamed data where the total length is not known in advance. Data produced by BER is 8-bit, but many transports are limited to 7-bit data. Therefore, in most situations, a suitable 7-bit Content-Transfer-Encoding is needed, such as base64. PKCS #7 has a provision for "detached data", where, for example, the SignedData in the ContentInfo contains only the signature information, but not the actual data which is signed (which is transferred separately). S/MIME agents using application/pkcs7-mime MUST NOT use detached data, and the data MUST be present within the ContentInfo. PKCS #7 provides for a degenerate case of SignedData which can be used for disseminating certificates and CRLs. This is explicitly allowed in application/pkcs7-mime. In this case, the content is omitted from the ContentInfo and there are no entries in the SignerInfos, leaving only entries for certificates and CRLs. Typically, this is used to convey certificates in response to a certification request, or CRLs in response to a CRL retrieval request. The MIME agent SHOULD process and store the certificates and CRLs and may choose to display a confirmation to the user. The requirement that the signed or enveloped data has to itself be a MIME body part is the reason the protocol defined here is called "application/pkcs7-mime" and not "application/pkcs7". A protocol for transferring a PKCS #7 object with arbitrary signed or enveloped content could be defined, but is outside the scope of this draft. 3.1.2 Format of the Signed or Enveloped application/pkcs7-mime Data PKCS #7 places no requirements on the format of the data which is signed or enveloped. However, for use in application/pkcs7-mime, the signed or enveloped data is itself a MIME entity. Therefore, when a MIME agent receives an application/pkcs7-mime object, the result of removing the signature or envelope can be passed directly to the normal MIME-processing software. Because the MIME entity being signed or enveloped is likely to be transferred to and processed on a different platform than it was created, the data MUST be in MIME canonical format. The most common difference between platforms is the end of line delimiter. There are other considerations for the selection of the transfer encoding for the MIME entity that affect the ability to verify the signature of a received MIME entity, especially if it is to be subsequently forwarded. The data that is signed or enveloped has to be recovered by the recipient in the exact form it was produced by the sender, so agents MUST be sure that this data be in a canonical format which can be processed by any platform. Converting a message into canonical format is covered in [MIME-SPEC]. When creating a full MIME entity, the encoded sub-entities are inserted in the full MIME entity. This step consists essentially of concatenating the sub-entities interspersed with the appropriate MIME Content-type, Content-Transfer-Encoding, and related headers and part boundaries. Note that MIME headers and boundaries are all text with canonical line endings. 3.1.3 Outside Content Transfer Encoding The body of application/pkcs7-mime is a BER-encoded PKCS #7 ContentInfo. However, as mentioned above, the result of BER-encoding is binary data, not 7-bit text. If S/MIME is being used in a system that requires 7-bit text, such as SMTP, a content transfer encoding must be used. In general, base64 Content-Transfer-Encoding can be used, although all that is required is that the transfer encoding be such that application/pkcs7-mime entity can be transferred intact. (It is even possible that the transfer encoding will be changed by the message transfer agent, because this is explicitly permitted.) 3.1.4 Receiving an application/pkcs7-mime Body Part These are the steps for receiving an application/pkcs7-mime message. Step 1. Remove any content transfer encoding. Step 2. Examine the PKCS #7 ContentInfo to determine the PKCS #7 content type. Step 3. Process the inner content type according to PKCS #7. Step 4. Pass the result to a standard MIME processor which removes transfer encoding, splits multipart entities, and possibly converts the parts to local format. 3.2 Content-Type application/pkcs10 A typical application which allows a user to generate cryptographic information has to submit that information to a certification authority, who transforms it into a certificate. PKCS #10 describes a syntax for certification requests. The application/pkcs10 body type MUST be used to transfer a PKCS #10 certification request. The details of certification requests and the process of obtaining a certificate are beyond the scope of this draft. Instead, only the format of data used in application/pkcs10 is defined. 3.2.1 Format of the application/pkcs10 Body PKCS #10 defines the ASN.1 type CertificationRequest for use in submitting a certification request. Therefore, when the MIME content type application/pkcs10 is used, the body MUST be a CertificationRequest, encoded using the Basic Encoding Rules (BER). Although BER is specified, instead of the more restrictive DER, a typical application will use DER since the CertificationRequest's CertificationRequestInfo has to be DER-encoded in order to be signed. A robust application SHOULD output DER, but allow BER or DER on input. Data produced by BER or DER is 8-bit, but many transports are limited to 7-bit data. Therefore, a suitable 7-bit Content-Transfer-Encoding SHOULD be applied. The base64 Content-Transfer-Encoding SHOULD be used with application/pkcs10, although any 7-bit transfer encoding may work. 3.2.2 Sending and Receiving an application/pkcs10 Body Part For sending a certificate-signing request, the application/pkcs10 message format MUST be used to convey a PKCS #10 certificate-signing request. Note that for sending a certificates and CRLs messages without any signed content, the application/pkcs7-mime message format MUST be used to convey a degenerate PKCS #7 signedData "certs-only" message. To send an application/pkcs10 body, the application generates the cryptographic information for the user. The details of the cryptographic information are beyond the scope of this draft. Step 1. The cryptographic information is placed within a PKCS #10 CertificationRequest. Step 2. The CertificationRequest is encoded according to BER or DER (typically, DER). Step 3. As a typical step, the DER-encoded CertificationRequest is also base64 encoded so that it is 7-bit data suitable for transfer in SMTP. This then becomes the body of an application/pkcs10 body part. The result might look like this: Content-Type: application/pkcs10 Content-Transfer-Encoding: base64 rfvbnj756tbBghyHhHUujhJhjH77n8HHGT9HG4VQpfyF467GhIGfHfYT6 7n8HHGghyHhHUujhJh4VQpfyF467GhIGfHfYGTrfvbnjT6jH7756tbB9H f8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4 0GhIGfHfQbnj756YT64V A typical application only needs to send a certification request. It is a certification authority that has to receive and process the request. The steps for recovering the CertificationRequest from the message are straightforward but are not presented here. The procedures for processing the certification request are beyond the scope of this document. 3.3 Use of the Multipart/Signed Content-Type [MIME-SECURE] defines the multipart/signed content type explicitly for clear-signed messages. Clear signing means the content is in the clear so that recipients with systems that do not process PKCS information can still read the message even if they cannot verify the signature. The multipart/signed MIME type is a multipart type with exactly two parts. The first part carries the MIME entity being signed, and the second part carries the signature. The multipart/signed Content type has two parameters: - The protocol parameter (required) - The micalg parameter (optional) The protocol parameter MUST be "application/pkcs7-signature". Note that quotation marks are required around the protocol parameter because MIME requires that the "/" character in the parameter value MUST be quoted. The optional micalg parameter allows for one-pass processing when the signature is being verified. The value of the micalg parameter is dependent on the message digest algorithm used in the calculation of the Message Integrity Check. An example of a multipart/signed message is: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=rsa-md5; boundary=boundary42 --boundary42 Content-Type: text/plain This is a clear-signed message --boundary42 Content-Type: application/pkcs7-signature Content-Transfer-Encoding: base64 ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfHfYT6 4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbB9HGTrfvbnj n8HHGTrfvhJhjH776tbB9HG4VQbnj7567GhIGfHfYT6ghyHhHUujpfyF4 7GhIGfHfYT64VQbnj756 --boundary42-- 3.3.1 Preparation of the Data for Signing The data is prepared as described in section 3.2 with the following extra considerations for transfer encoding. All parts of the MIME entity MUST be encoded with 7-bit, quoted-printable, or base64 transfer encoding before computing the signature. No binary or 8-bit data is permitted. This means that receiving agents, even those on 8-bit-clean transport systems, MUST be able to remove 7-bit, quoted-printable, or base64 transfer encoding. The current Internet mail transport infrastructure cannot guarantee transport of unencoded binary or 8-bit data and because the digest for the signature is computed on the fully encoded message. If a message with 8-bit data were to encounter a message transfer agent (MTA) that can not transmit 8-bit or binary data it has three options, none of which are acceptable for a clear-signed message. - The MTA could change the transfer encoding, but that would invalidate the signature. - The MTA could transmit the data anyway, which would most likely result in the 8th bit being stripped, also resulting in the signature being invalidated. - The MTA could return the message to the sender. [MIME-SECURE] prohibits an MTA from changing the transfer encoding of the first part of a multipart/signed message. If a compliant MTA encountered a multipart/signed message with 8-bit or binary data in the first part, it would have to return the message to the sender as undeliverable. Sending agents may choose to use quoted printable transfer encoding in some situations where it may not otherwise seem necessary to better preserve the data so the signature can be verified. For example, trailing spaces should always be quoted-printable encoded because some mail systems strip them if they are not transferred with encoding. Also the word "From" followed by a space at the beginning of a line should be encoded as some mail systems convert this to ">From". Because of the restriction on 8-bit transport it is also necessary to use quoted printable encoding for text using an 8-bit character set such as ISO-8859-1. 3.3.2 The application/pkcs7-signature Type The second part of the multipart/signed message MUST be type application/pkcs7-signature. The data in the second part is the PKCS #7 detached signature. A detached signature is a PKCS #7 data object of type SignedData with the signerInfos field containing signatures on some external data and the ContentInfo field empty. In this case, the external data is the fully encoded MIME entity described above and placed in the first part of the multipart/signed message. 3.3.3 Procedure for Sending a Clear Signed Message Step 1. The data is prepared as described above so the transfer encoding of all the parts is either 7-bit, quoted-printable or base64. Step 2. The PKCS #7 detached signature for the data is computed. Step 3. The content data is inserted into the first part of the multipart/signed MIME entity. Step 4. The detached signature is inserted into the second part of the multipart/signed message using appropriate transfer encoding. 3.3.4 Procedure for Receiving a Clear Signed Message Step 1. The agent separates the two parts of the multipart/signed entity. Step 2. The message digest of the first part of the multipart/signed message is computed. Step 3. The application/pkcs7-signature information in the second part is processed along with the digest obtained in the first step to verify the signature. Step 4. The MIME processing and decoding of the first part proceeds and the message is presented to the user along with the result of the signature verification. 3.4 Nesting of S/MIME Security Services MIME allows for an arbitrarily complex structure that is frequently limited in practice to a basic functional subset. While the MIME specification allows an arbitrary depth of MIME entities nested within other MIME entities, the addition of security services to a MIME message makes arbitrary nesting difficult to implement and challenging to convey to a user in a meaningful way. As with other areas in the S/MIME specification, requirements and recommendations are made which attempt to balance the concerns of utility versus simplicity. If a user chooses to both sign and envelope a message to another user, this can be accomplished in two ways: - by creating a PKCS #7 signedAndEnvelopedData content type - by separately creating a signedData content type then using the result as input to create an envelopedData content type Concerns have been voiced about the fact that the signedAndEnvelopedData content type exposes the identities of the S/MIME signatories (i.e. the issuerAndSerialNumber for each signatory is not protected in the envelope). In order to accommodate the protection of signatory information within enveloped messages all sending and receiving agents MUST support the nesting of signed messages within enveloped messages. If an incoming enveloped message is decrypted and the resulting MIME entity is a signed application/pkcs7-mime, then the user agent SHOULD automatically process the resulting MIME entity and present the signature status and corresponding information to the user. Likewise, if a user chooses to sign and encrypt an outgoing message, then the user agent SHOULD automatically create an application/pkcs7-mime signed message then use the resulting message as input to the creation of an application/pkcs7-mime enveloped message. In the case of this signed/enveloped nesting, the inner signed message SHOULD be left in its binary state and that the content transfer encoding on the inner signed message be indicated as binary. There are a number of useful security functions that can be achieved by allowing additional nesting of security services. An receiving agent SHOULD allow for automatic processing of one or two additional layers of S/MIME entities nested in other S/MIME entities. Where additional nesting is not automatically handled, some provision SHOULD be made to handle additional nesting manually, such as through some explicit user action such as the resubmission of the resulting message to the user agent. 3.5 Choosing the Message Type for Outgoing Signed Messages There are two distinct mechanisms for conveying a signed message: - a signed, self-contained application/pkcs7-mime construct - a multipart/signed construct (where the signature is conveyed separate from the signed data in an application/pkcs7-signature body part) Sending agents MUST support creation of both application/pkcs7-mime and multipart/signed messages. Therefore, receiving agents MUST be able to process signatures from both types of messages. In many Internet mail transactions, there is a reasonable expectation that MIME messages will be delivered intact. However, because of the limitations inherent in a significant portion of existing mail infrastructure, not all S/MIME-enabled agents will be able to correctly receive and/or process multipart/signed messages. For example, some older gateways and message transfer agents will treat unknown multipart messages such as multipart/signed as multipart/mixed and discard the MIME packaging for the signed message, leading to unverifiable signatures. One of the greatest values of the multipart/signed construct is in the ability of agents which are not S/MIME-enabled to be able to handle the (otherwise unencoded) body of the message that was signed. Thus, multipart/signed SHOULD be used when a signed message is being sent to a set of recipients where the S/MIME capabilities are not all known. If the sending agent believes that a particular recipient might not be able to receive a multipart/signed message successfully due to improper gateways, the agent can either: - wrap the multipart/signed message in another MIME envelope using application/mime, as described in [MIME-APP] - use application/pkcs7-mime instead of multipart/signed Both methods have advantages and drawbacks. Because of the newness of the specification, few gateways would try to break open an application/mime message, and this should thus shield the contents fairly well. Further, because application/mime messages are plain text, non-MIME recipients of such a message would still be able to read it (albeit after visually parsing the message). However, because of the newness of the specification, few of the currently-implemented S/MIME receiving agents would know what to do with an application/mime message. All receiving S/MIME agents do know how to interpret application/pkcs7-mime messages, so using this scheme will lead to good interpretation by S/MIME-aware agents. However the contents of an application/pkcs7-mime message are indecipherable to non-S/MIME receiving agents. When all of the intended recipients are known to be S/MIME-capable, the sending agent SHOULD use application/pkcs7-mime because it has a greater possibility of successful receipt through unknown gateways. The availability of certificates for all intended message recipients and/or S/MIME-specific entries in an addressbook or database may be a good indication that all recipients are S/MIME-capable. 3.5.1 Sending to Mailing Lists Sending agents often send messages to recipients on public mailing lists and systems outside traditional Internet mail like Usenet. As stated earlier, one of the important benefits of multipart/signed messages is that their text portions can be displayed (but not verified) by non-S/MIME and by non-MIME recipients. If application/pkcs7-mime is used instead of multipart/signed, the message will only be readable by recipients with S/MIME tools. Therefore, implementors of S/MIME agents SHOULD attempt to ensure that application/pkcs7-mime messages are never sent to public forums which have participation from non-S/MIME-enabled users. If a sending agent cannot generate multipart/signed, and the user of that agent wants to sign a message that is being sent to a recipient who has not explicitly advertised support for application/pkcs7-mime, then the sender SHOULD be warned that some users may not be able to read the message at all if sent in signed form, and that they should only proceed if they are confident that all recipients have S/MIME capability. Because you generally cannot know all the capabilities of all the recipients of a mailing list or similar forum, the use of application/pkcs7-mime SHOULD be strongly discouraged for messages sent to these types of lists and, if allowed at all, appropriate warnings SHOULD be issued. 3.5.2 Choice Matrix Summary This chart describes when a sending agent SHOULD use each MIME type: MIME Type When to Use application/pkcs7-mime When sending envelopedData When sending signedData to only S/MIME-capable recipients where multipart/signed is expected to not arrive intact When sending a certs-only message multipart/signed Default for sending a signed message; required when sending a signed message to a mix of recipients where S/MIME- capabilities are not known for all recipients application/mime When sending multipart/signed to recipient who may or may not be S/MIME-capable and the message is expected to not arrive intact application/pkcs10 When sending a certification request to a certification authority 3.6 Relationship to File-Based MIME Security The use of S/MIME is not limited to the on-line mail environment. By associating standard file extensions to the various S/MIME content types, useful automatic conversion can occur between agents and file-based S/MIME processing capabilities in a receiving agent or at the operating system level. The MIME Content-Type header field has an optional parameter, "name", that is useful for saving body parts on disk at the recipient's site. The MIME Content-Disposition header field, with the value "attachment" also has an optional parameter, "filename", for saving body parts on disk at the recipient's site. Sending agents SHOULD emit the optional name parameter to the Content-Type field for the for compatibility with older systems. Sending agents SHOULD emit the optional Content-Disposition field with the filename parameter. If a sending agent emits a Content-Disposition field with the filename parameter, it MUST use the file extensions listed below that is consistent with the content type. Both of these parameters SHOULD be set to the same filename with extension. For support of legacy systems (i.e. DOS) the filename should be limited to eight characters followed by a period followed by a three letter extension. The eight character filename base can be any distinct name; the use of the filename "smime" SHOULD be used to indicate that the MIME entity is associated with S/MIME. The filename extensions MUST correspond to the S/MIME message types from this table: S/MIME Type File Extension application/pkcs7-signature .p7s application/pkcs7-mime .p7m (for signedData and envelopedData) application/pkcs7-mime .p7c (degenerate signedData "certs-only" message) application/pkcs10 .p10 For instance: Content-Type: application/pkcs7-mime;name="smime.p7m" Content-Transfer-Encoding: base64 Content-Disposition: attachment;filename="smime.p7m" <base64 data goes here> If this message were of type application/pkcs10, then the filename would be something like "smime.p10". If S/MIME constructs are saved to or imported from disk, the same file extensions SHOULD be used. This allows for static registry of the filename extension and a particular associated "helper" application in certain application environments. Certain older MIME agents and gateways automatically convert unknown subtypes of the MIME "application" type to application/octet-stream. Sending agents including the optional name parameter and the optional Content-Disposition: attachment;filename= parameter give at least some indication that the included MIME entity is an S/MIME entity. S/MIME agents and "helper" applications SHOULD be capable of processing application/octet-stream messages with recognized S/MIME filename extensions either automatically or by explicit user action. 4. Certificate Processing A receiving agent MUST provide some certificate retrieval mechanism in order to gain access to certificates for recipients of digital envelopes. This draft does not cover how S/MIME agents handle certificates, only what they do after a certificate has been validated or rejected. S/MIME certification issues are covered in a different document. At a minimum, for initial S/MIME deployment, a user agent could automatically generate a message to an intended recipient requesting that recipient's certificate in a signed return message. Receiving and sending agents SHOULD also provide a mechanism to allow a user to "store and protect" certificates for correspondents in such a way so as to guarantee their later retrieval. 4.1 Key Pair Generation An S/MIME agent or some related administrative utility or function MUST be capable of generating RSA key pairs on behalf of the user. Each key pair MUST be generated from a good source of non-deterministic random input and protected in a secure fashion. 4.1.1 Restricted Profile A restricted agent MUST generate 512 bit RSA key pairs for key management. In many cases, the same RSA key pair is used both for key management and signatures. Where there are mechanisms to support the separation of keying material for signatures versus key management, a restricted agents SHOULD generate and use RSA keys with key sizes from 768 bits to 1024 bits for signatures. 4.1.2 Unrestricted Profile An unrestricted agent SHOULD generate RSA key pairs at a minimum key size of 768 bits and a maximum key size of 1024 bits because this is the largest key size which can be used by restricted S/MIME agents for key management. 4.1.3 History of Restrictions Due to US Government export regulations, an S/MIME agent which supports the generation of large RSA key sizes for key management would not be freely exportable outside of North America. US software manufacturers have been compelled to limit the key sizes of RSA keys generated for key management in order to create a widely exportable "restricted" version of their product. S/MIME agents intended for domestic use (or use under special State Department export licenses) can generate larger key sizes. However, in order to achieve the widest possible interoperability, such agents SHOULD limit the size of generated keys to those supported in restricted S/MIME agents. Appendix A - Object Identifiers & Syntax The syntax for SMIMECapability is: SMIMECapability ::= SEQUENCE { capabilityID OBJECT IDENTIFIER, parameters OPTIONAL ANY DEFINED BY capabilityID } SMIMECapabilities ::= SEQUENCE OF SMIMECapability A.1 Content Encryption Algorithms RC2-CBC OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 2} For the effective-key-bits (key size) other than 32 and less than 256, the RC2-CBC algorithm parameters are encoded as: RC2-CBC parameter ::= SEQUENCE { rc2ParameterVersion INTEGER, iv OCTET STRING (8)} For the effective-key-bits of 40, 64, and 128, the rc2ParameterVersion values are 160, 120, 58 respectively. RC5-CBCPad OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 9} RC5_CBC_PARAMETER ::= SEQUENCE { version INTEGER (v1_0(16)), rounds INTEGER (8..127), blockSizeInBits INTEGER (64, 128), iv OCTET STRING OPTIONAL} For S/MIME, we use 16 rounds and a 64 bit block size. DES-CBC OBJECT IDENTIFIER ::= {iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2) 7} DES-EDE3-CBC OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) encryptionAlgorithm(3) 7} For DES-CBC and DES-EDE3-CBC, the parameter should be encoded as: CBCParameter :: IV where IV ::= OCTET STRING -- 8 octets. A.2 Digest Algorithms md5 OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) digestAlgorithm(2) 5} sha-1 OBJECT IDENTIFIER ::= {iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2) 26} A.3 Asymmetric Encryption Algorithms rsaEncryption OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 1} rsa OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) algorithm(8) encryptionAlgorithm(1) 1} A.3 Signature Algorithms md2WithRSAEncryption OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 2} md5WithRSAEncryption OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 4} sha-1WithRSAEncryption OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5} A.4 Signed Attributes signingTime OBJECT IDENTIFIER ::= {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-9(9) 5} B. References [MIME-APP] "Wrapping MIME Objects: Application/MIME", Internet Draft draft-crocker-wrap-01.txt. [MIME-SPEC] The primary definition of MIME. "MIME Part 1: Format of Internet Message Bodies", RFC 2045; "MIME Part 2: Media Types", RFC 2046; "MIME Part 3: Message Header Extensions for Non-ASCII Text", RFC 2047; "MIME Part 4: Registration Procedures", RFC 2048; "MIME Part 5: Conformance Criteria and Examples", RFC 2049 [MIME-SECURE] "Security Multiparts for MIME: Multipart/Signed and Multipart/Encrypted", RFC 1847 [PEM] "Privacy-Enhanced Mail (PEM) basics", RFC 1421 [PKCS-1], "PKCS #1: RSA Encryption Standard", submission of draft pending [PKCS-7], "PKCS #7: Cryptographic Message Syntax Standard", submission of draft pending [PKCS-9], "PKCS #9: Selected Attribute Types", submission of draft pending [PKCS-10], "PKCS #10: Certification Request Syntax Standard", submission of draft pending C. Compatibility with Pre-standards S/MIME S/MIME was originally developed by RSA Data Security, Inc. Many developers implemented S/MIME agents before the standard was turned over to the IETF. All S/MIME receiving agents SHOULD make every attempt to interoperate with pre-standards S/MIME sending agents. C.1 Pre-standards MIME Types Pre-standard S/MIME agents used the following MIME types: application/x-pkcs7-mime application/x-pkcs7-signature application/x-pkcs10 In each case, the "x-" subtypes correspond to the subtypes described in this document without the "x-". D. Revision History This draft is a combination of an earlier draft, draft-dusse-mime-msg-spec-00, which specified the format for S/MIME messages, and the "S/MIME Implementation Guide, Interoperability Profiles, Version 2", a document from RSA Data Security. This draft includes changes to the wording, but not the intent, of both documents. Part of the "Implementation Guide" document was split out into a draft that describes S/MIME certification issues. This draft supersedes draft-dusse-mime-msg-spec-00, which is now expired. E. Open Issues Split out Section 3 as a stand-alone document. Also, add back description of how to do content transfer encoding. What to do if sending to multiple people with different known capabilities? What if sending to a group, some of whom have known capabilities, others with unknown? Whether or not the PKCS-nn documents will be IETF RFCs or simply be referenced as external documents. References to the encryption and hash algorithms. Use of the S/MIME trademark. Include an appendix with the proper requests for new MIME subtypes. Need to list text values for the micalg parameter of multipart/signed. RFC 1848 lists only "RSA-MD2" and "RSA-MD5", not "SHA-1". Need new wording for section 3.5's "improper gateways" discussion. Need to make it clear that multipart/signed is always strongly preferred. Lawrence will reorder and rewrite all of section 3. No changes to the spec, but will make it easier to implement from. Should nesting be restricted like it is now? Look at the use of PKCS-7 "data" format. Should 8-bit text be allowed? Revisit binary MIME. Look at canonicalization issues for signing What does PEM compatibility mean/entail, and do we care? Remove and/or deprecate signedAndEnveloped in the draft. Make the micalg parameter required, not optional. Do we need better heuristics for determining the encryption capabilities of a recipient? What about guessing based on key length? Need to change the wording in Section 2.6.3 to indicate that it is discussing all capabilities, not just encryption. F. Trademarks RSA Data Security, Inc., owns the US trademark for the name "S/MIME" and for a logo associated with that name. RSA Data Security, Inc., is currently in discussions with the IETF about the use of the name "S/MIME" for interoperable message security. The name "S/MIME" may or may not be used in future versions of this draft. G. Acknowledgements Significant contributions to the content of this draft were made by many people, including: Jeff Thompson Jeff Weinstein H. Authors' addresses Steve Dusse RSA Data Security, Inc. 100 Marine Parkway, #500 Redwood City, CA 94065 USA (415) 595-8782 spock@rsa.com Paul Hoffman Internet Mail Consortium 127 Segre Place Santa Cruz, CA 95060 (408) 426-9827 phoffman@imc.org Blake Ramsdell Deming Internet Security 13122 NE 20th St., Suite C Bellevue, WA 98005 (206) 882-8861 blaker@deming.com Laurence Lundblade QUALCOMM Incorporated Eudora Division 6455 Lusk Boulevard San Diego, California 92121-2779 (800) 238-3672 lgl@qualcomm.com Lisa Repka Netscape Communications Corporation 501 East Middlefield Road Mountain View, CA 94043 (415) 254-1900 repka@netscape.com