Re: [lamps] Advertising S/MIME capabilities in a certificate?

[Russ Housley <[e-mail]>]

DKG:

This seems very similar  to the attribute specified in RFC 5751 that indicates binary message bodies can be handled:

   Implementations MAY "know" that recipient implementations are capable
   of handling inner binary MIME entities either by interpreting the
   id-cap-preferBinaryInside SMIMECapabilities attribute ...

Russ

> On Nov 22, 2019, at 6:07 AM, Daniel Kahn Gillmor <[e-mail]> wrote:
> 
> Hi folks--
> 
> It occurs to me that i'd like at least one of the certificates in
> https://www.ietf.org/id/draft-dkg-lamps-samples-01.html to announce some
> SMIMECapabilities.  For example, maybe it could advertise that it is
> capable of handling a PKCS#7 Compression layer?  Or that it is capable
> of processing authEnveloped-data?
> 
> However, reading RFC 8551 and related specs i realize how rusty my ASN.1
> is (and my knowledge of CMS is so paltry that there was never even
> enough of it to rust).
> 
> It looks to me like S/MIME capabilities are never advertised in the cert
> itself, but rather expected to be included as a signedAttribute in a
> signedData object.  Is that right?  Is there no way that the
> advertisement can be included in the certificate?
> 
> I suppose if the advertisement could be included in both the signedData
> object *and* the certificate itself then the algorithm in §2.7.1 of RFC
> 8551 would need to be much more complicated.
> 
> Any pointers or examples would be welcome,
> 
>              --dkg