Re: [secdir] Secdir review of draft-baker-ietf-core-03.txt

[Steven Bellovin <[e-mail]>]

On Nov 20, 2009, at 11:41 PM, Charlie Kaufman wrote:

>  
> Section 3.1.4: I’d be surprised if S/MIME was originally an extension to SMTP. Even when S/MIME was PEM, it was largely transport independent (and designed to pass over X.400, which was a contender in those days). S/MIME – and more generally CMS – is not really a networking protocol at all. It is designed to protect data at rest. I can take a CMS protected file and send the pile of bits to you by floppy disk or paper tape. Years later, if you can still read the media, you can still process it. It’s a tough call whether it is an Internet Core Protocol. It’s certainly an important IETF protocol.

That section is incorrect in several respects, in my opinion.  First, S/MIME doesn't protect "SMTP Mail", in my opinion, since to me "SMTP" is referring to the 821/2821/5321 parts of the protocol.  S/MIME is more for the 822/2822/5322 parts.  More precisely, S/MIME is a way to put in security at the MIME layer (references omitted), which in turn extend 822/2822/5322.  The distinction is important because HTTP uses MIME but not SMTP.  (It could have used S/MIME, but that's a separate wistful thread.)  Second, it's an interesting question if CMS should be mentioned separately -- you can't do S/MIME without CMS.


		--Steve Bellovin, http://www.cs.columbia.edu/~smb