Subject: [AAA-WG]: Issue 133: digest value within CMS-Signed-Data AVP

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 07:38:49 -0700

The proposed text reads:

"Instead, the digest value of the AVPs produced in the 
signature process MUST be included in the CMS-Signed-Data 
AVP as a message-digest attribute in the SingerInfo value. 
This attribute MUST be always signed."

What attribute must be signed, and are we talking about digital
signatures, or the format of the field?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 09:57:05 +0200

> signatures, or the format of the field?

That sentence is actually redundant. It simply regards the CMS
specification (RFC 2630) but, in fact, I misread the paragraph since 
"The countersignature attribute must be an unsigned attribute".
Anyway, it has only to do with objects of SignedData type, so that
this sentence can be dropped since the process to generate a CMS
SignedData object will always keep countersignature as an unsigned
attribute.

Regards

  // M.A.

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 10:23:31 +0200

Please, drop the previous mail... I was cross-answering several Pat's
mails and I've mixed the content of two of them...

What I wanted to say is depicted below:

> signatures, or the format of the field?

That sentence is actually redundant. It simply "quotes" the CMS
specification (RFC 2630) which says that (in signing context) "The
message-digest attribute must be a signed attribute". That is, in the
framework of CMS SignedData objects, message-digest attributes must be
signed. However, saying that in the Diameter CMS specification can be
confused. I agree on dropping that sentence since the process to
generate a CMS SignedData object will always keep message-digest as a
signed attribute.

The paragraph should be something like the following: 

"Instead, the digest value of the AVPs produced in the
signature process MUST be included in the CMS-Signed-Data
AVP as a message-digest attribute in the SingerInfo value
(message-digest attributes are defined in 11.2 of [3])"

Regards

  // M.A.