Re: Compatibility between S/MIME v2 & v3 signatures

["Housley, Russ" <[e-mail]>]

Gwangsoo:

If you review the details of PKCS#1 v1.5, I think that you will see that 
the same structure as DigestInfo is used there.  This structure is not used 
by other digital signature techniques.

Russ

At 10:42 PM 6/4/2002 +0900, Gwangsoo Rhee wrote:
>Russ:
>
>Thanks for your answer.
>But, my question wasn't about the algorithm, but about
>what is to be encrypted by the signature algorithm like RSA.
>Does the RSA in S/MIME v3 (or RFC 2630) encrypt the DigestInfo
>which includes the digestAlgorithm, too?
>If so, why didn't RFC 2630 mention about it, or
>why did RFC 2630 leave out the DigestInfo structure?
>
>Thanks again.
>
>"Housley, Russ" wrote:
>
> > Gwangsoo:
> >
> > RFC 2315 only supports PKCS#1 v1.5 RSA signatures.  RFC 2630 and rfc2630bis
> > support any signature algorithm.  So, the more correct backward
> > compatibility statement is: RFC 2630 is backwards compatible with RFC 2315
> > when PKCS#1 v1.5 RSA signatures are used.
> >
> > Russ
> >
> > At 10:08 AM 6/4/2002 +0900, Gwangsoo Rhee wrote:
> >
> > >Hello, everybody.
> > >
> > >Many documents including draft-ietf-smime-rfc2630bis-08.txt
> > >claim that S/MIME v2 & v3 signatures are compatible, BUT:
> > >
> > >Sec. 9.4 of RFC 2315 (PKCS #7 v1.5) states about the signature
> > >generation:
> > >
> > >    The result of the
> > >    digest-encryption process is the encryption with the signer's private
> > >
> > >    key of the BER encoding of a value of type DigestInfo:
> > >
> > >    DigestInfo ::= SEQUENCE {
> > >      digestAlgorithm DigestAlgorithmIdentifier,
> > >      digest Digest }
> > >
> > >And sec. 5.5 of RFC 2630 (CMS) states:
> > >
> > >    The input to the signature generation process includes the result of
> > >    the message digest calculation process and the signer's private key.
> > >
> > >This RFC has no mention of DigestInfo structure.
> > >It seems to me that DigestAlgorithmIdentifier doesn't
> > >contribute to the signature generation, and in that case
> > >those two signatures cannot be compatible.
> > >
> > >Can anyone please point out where I got this wrong?
> > >
> > >Thanks.
> > >
> > >--
> > >
> > >---------------------------------------
> > >Gwangsoo Rhee <[e-mail]>
> > >tel: [phone]  fax: [phone]
> > >HP: 011-9691-9541
> > >---------------------------------------
>
>--
>
>---------------------------------------
>Gwangsoo Rhee <[e-mail]>
>tel: [phone]  fax: [phone]
>HP: 011-9691-9541
>---------------------------------------