[Jmap] Robert Wilton's No Objection on draft-ietf-jmap-smime-09: (with COMMENT)

[Robert Wilton via Datatracker <[e-mail]>]

Robert Wilton has entered the following ballot position for
draft-ietf-jmap-smime-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/blog/handling-iesg-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-jmap-smime/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Hi,

I have to confess that I don't know IMAP, and hence my question may have an
obvious answer, but it is unclear to me whether a server supporting the
smimeverify capability implies that it SHOULD also support checking the S/MIME
signature at delivery time?  If this is the case, should this be clarified,
perhaps in section 3?

I.e., section 3 states:
   Servers supporting
   _this_ specification MUST add a property called
   "urn:ietf:params:jmap:smimeverify" to the capabilities object.

E.g., section 4.1 states:

   signed:  S/MIME signed message, but the signature was not yet
      verified.  Some servers might not attempt to verify a signature
      until a particular message is requested by the client.  JMAP
      servers compliant with this document SHOULD return "signed/
      verified" or "signed/failed" instead of this signature status.

These two statements seem to imply that a server returning the smimeverify
capability SHOULD also support checking the S/MIME signature at delivery
because they SHOULD either return signed/verified or signed/failed for a
request for smimeStatusAtDelivery, which at least implies that they have
previously checked the signature when it was delivered.  Is that was is
intended?

Thanks,
Rob