[smime] RFC 5752 on Multiple Signatures in Cryptographic Message Syntax (CMS)

A new Request for Comments is now available in online RFC libraries.

        RFC 5752

        Title:      Multiple Signatures in Cryptographic Message 
                    Syntax (CMS) 
        Author:     S. Turner, J. Schaad
        Status:     Standards Track
        Date:       January 2010
        Mailbox:    turners@ieca.com, 
                    jimsch@exmsft.com
        Pages:      17
        Characters: 34502
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-smime-multisig-05.txt

        URL:        http://www.rfc-editor.org/rfc/rfc5752.txt

Cryptographic Message Syntax (CMS) SignedData includes the SignerInfo
structure to convey per-signer information.  SignedData supports
multiple signers and multiple signature algorithms per signer with
multiple SignerInfo structures.  If a signer attaches more than one
SignerInfo, there are concerns that an attacker could perform a
downgrade attack by removing the SignerInfo(s) with the 'strong'
algorithm(s).  This document defines the multiple-signatures
attribute, its generation rules, and its processing rules to allow
signers to convey multiple SignerInfo objects while protecting against
downgrade attacks.  Additionally, this attribute may assist during
periods of algorithm migration.  [STANDARDS TRACK]

This document is a product of the S/MIME Mail Security Working Group of the IETF.

This is now a Proposed Standard Protocol.

STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements.  Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol.  Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC