RE: Question about security of header.

"Blake Ramsdell" <BlakeR@deming.com> Fri, 26 February 1999 10:29 UTC

Message-ID: <01FF24001403D011AD7B00A024BC53C563DF04@mail.deming.com>
From: Blake Ramsdell <BlakeR@deming.com>
To: 'Taweesak Chairatanayut' <pok@nectec.or.th>, ietf-smime@imc.org
Subject: RE: Question about security of header.
Date: Fri, 26 Feb 1999 02:34:23 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Sender: owner-ietf-smime@imc.org
Precedence: bulk

> -----Original Message-----
> From: Taweesak Chairatanayut [mailto:pok@nectec.or.th]
> Sent: Friday, February 26, 1999 1:41 AM
> To: ietf-smime@imc.org
> Subject: Question about security of header.
> 
> 	According to rfc of S/MIME V.2.0, i have a question 
> about header.
> How can i be so sure that the header of e-mail didn't be 
> changed because
> from S/MIME V.2.0 i couldn't find that header can be 
> authenticated or not
> ( i think no, right ?). Do you have any idea of header 
> authentication ?
> Please advise.

The outer RFC822 headers (Received, To, From, Subject, etc.) are not
protected by the S/MIME v2 or v3 profile.

A way to do header authentication is to wrap an entire message/rfc822 in
SignedData.

Blake
--
Blake C. Ramsdell
Worldtalk Corporation
For current info, check http://www.deming.com/users/blaker
Voice +1 425 882 8861 x103  Fax +1 425 882 8060

RE: Question about security of header. Taweesak Chairatanayut
RE: Question about security of header. Blake Ramsdell
Question about security of header. Taweesak Chairatanayut