Subject: [AAA-WG]: [issue] digest value within CMS-Signed-Data AVP

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 22 Aug 2001 19:00:16 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-22
Reference: 
Document: CMS-02
Comment type: E
Priority: 1
Section: 6.1
Rationale/Explanation of issue: 

In 6.1 (last sentence of page 20), it's stated that not the whole
content being signed but just a digest is inserted:

   Instead, the digest value within the SignedData 
   structure contains the digest produced in the 
   signature process.

This paragraph isn't clear so that there isn't any digest value within
a SignedData structure. The correct name for it is message-digest
attribute type (as defined in [CMS, 11.2]). An attribute of this type
may be inserted into any of the SignerInfo values that comprises
Signed Data SignerInfos (take into account that this value would be
the same for all the SingerInfo value, so that only one digest
algorithm must be supported in [CMSSec]). However, this attribute is
only required (in [CMS, 11.2]) if any other attribute is present (if
present, message-digest is a SignedAttribute). As the [CMSSec]
specification allows countersignature operations, an attribute of this
type must be required.

Requested change: 

I'd replace the previous sentence with:

   Instead, the digest value of the AVPs produced in the 
   signature process MUST be included in the CMS-Signed-Data
   AVP as a message-digest attribute in the SingerInfo value.
   This attribute MUST be always signed.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -