Re: [Ieprep] Discussion of Internet-Draft for SMTP priorities

On Wed, Jun 14, 2006 at 07:12:08AM -0400, ken carlberg wrote:
> [...]
> >>Outside of that, it would seem desirable for your draft to at least
> >>advocate some measures of security like S/MIME for header protection
> >>(rfc-3851), and possibly the use of AUTH.
> >
> >S/MIME is strictly for the content of the email. This area has been
> >left out of the draft because of reasons stemming from the research
> >project I work on. In the general case it is probably a good idea to
> >at least consider this area. As for AUTH, you are completedly right.
> 
> Section 3.1 of rfc-3851 has the following text...
> 
>    In order to protect outer, non-content related message headers (for
>    instance, the "Subject", "To", "From" and "CC" fields), the sending
>    client MAY wrap a full MIME message in a message/rfc822 wrapper in
>    order to apply S/MIME security services to these headers.  It is up
>    to the receiving client to decide how to present these "inner"
>    headers along with the unprotected "outer" headers.
> 
>    [...]
> 
> I was under the impression that the above left the door open for S/ 
> MIME to protect static parts of the SMTP header.  But admittedly, I'm  
> not deeply familiar with the draft, so my apologies if I've  
> misinterpreted things.

To me, this appears rather to be a problem of different definitions of
the term content than a misinterpretation. I meant content as in
"message content" that is defined in Sec. 2.3.9 of RFC 2821 (SMTP) as
  "the material transmitted after the DATA command is accepted and
   before the end of data indication is transmitted.  Message content
   includes message headers and the ... message body."
In this definition the email header is part of the content. As such it
may be secured using S/MIME but still is outside the (current) scope
of the draft.

S/MIME obviously has a different definition of the term "content" that
only includes (parts of?) what is called "message body" but excludes
at least some header fields (probably those defined in RFCs
2821/2822).

Greetings,
Michael
-- 
****************************************************
| Michael Schmeing       E-Mail:  schmeing@fgan.de |
| FGAN/FKIE              Tel: (+49) 228/9435 593   |
| Neuenahrer Strasse 20  Fax: (+49) 228/9435 685   |
| D-53343 Wachtberg, Germany                       |
****************************************************

_______________________________________________
Ieprep mailing list
Ieprep@ietf.org
https://www1.ietf.org/mailman/listinfo/ieprep