Subject: [AAA-WG]: Issue 134: Several CMS-Encrypted-Data AVPs in a message

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 08:48:38 -0700

All,

The following text is currently present in the I-D:

"CMS-Encrypted-Data MAY contain more than one CMS object, that is, 
implementations MUST be able to add a new CMS-Encrypted-Data
AVP value and also MUST be able to decrypt all CMS-Encrypted-Data
AVP values which are encrypted for them."

This issue is a request to clarify the somewhat ambiguous text in
the draft. I would like to propose the following text instead:

"A CMS-Encrypted-Data AVP MAY contain more than one EnvelopedData, 
where one or more AVP would be encrypted within separate 
EnvelopedData structures. However, implementations MUST be able 
to support the presence of multiple CMS-Encrypted-Data AVPs, where 
one or more AVP is added to a separate CMS-Encrypted-Data AVP. 
Finally, a receiver MUST be able to decrypt all CMS-Encrypted-Data 
AVPs for which it is a recipient, as indicated in the 
EnvelopedData's RecipientInfos field [3]. "

Would this work?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 16:24:43 +0200

> EnvelopedData's RecipientInfos field [3]. "

Unfortunately, I'm not quite sure.

Let's say that a CMS-Encrypted-Data AVP contains several EnvelopedData
structures. I assume that it's made by means of S/MIME (BTW, no MIME
mention is done in 6.3, CMS-Encrypted-Data AVP). What I've missed is
the last sentence. If a CMS-Encrypted-Data contains several
EnvelopedData values, the receiver can be only able to decrypt all
EnvelopedData within CMS-Encrypted-Data AVPs for which it is a
recipient (so that the RecipientInfo value belongs to EnvelopedData
not to CMS-Encrypted-Data).

Comments?

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 28 Aug 2001 08:54:36 -0700

> not to CMS-Encrypted-Data).

Ah, I see the confusion. How about:

"Finally, a receiver MUST be able to decrypt any EnvelopedData for
which it is a recipient, as indicated in the EnvelopedData's
RecipientInfos field [3], and the receiver MUST be able to process
one or more CMS-Encrypted-Data AVPs"

Does this make more sense?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 18:52:34 +0200

> Does this make more sense?

Yes, it make more sense. This issue may be closed.

However, I'm still concerned about MIME (no mention about it has been
made). Since it's a little bit long, I'll write the point in a
separate issue.

Regards

  // M.A.