Subject: Re: iMIP, RFC2447 and [RFC-1847]-compliant encryption

From: [email-masked]
Date: Fri, 14 Jan 2000 20:33:39 -0500

I like the worded suggestion in this note.  It's clear, brief and to the 
point.
___________________
Patricia Egen Consulting
www.egenconsulting.com
423-875-2652

Paul Overell <[email-masked]>
Sent by: [email-masked]
01/14/00 05:16 AM

        To:     [email-masked]
        cc: 
        Subject:        Re: iMIP, RFC2447 and [RFC-1847]-compliant encryption

In article <[email-masked]>, Doug Royer
<[email-masked]> writes
>
>Paul Overell wrote:
>>
>> iMIP, RFC2447 says:
>>
>> >2.2.3 Confidentiality
>> >
>> >   To ensure confidentiality using iMIP implementations should utilize
>> >   [RFC-1847]-compliant encryption.
>> >
>>
>> This implicitly excludes S/MIME encryption (RFC2633 etc) as S/MIME's
>> encryption is not [RFC-1847]-compliant - i.e. S/MIME does not use
>> multipart/encrypted.
>>
>> Is this exclusion of S/MIME intentional or have I misunderstood
>> something here?
>>

>As I could not find a reply to this, I'll try.
>

Thanks - I was beginning to feel left out  :).

>We want S/MIME, and most of us are not security experts, what
>do you suggest? Is there a better text or RFC, or should
>it be dropped?
>

I know of no better RFC.   PGP/MIME encryption is RFC1847 compliant,
S/MIME encryption isn't.

As S/MIME was not explicitly specified I assume that the intention was
to leave the actual encryption scheme unspecified.

You ask for a suggestion, how about:

        To ensure confidentiality using iMIP implementations SHOULD
        utilize encryption.  It is outside the scope of this memo to
        specify specific encryption schemes.

Regards
-- 
Paul Overell                                        T U R N P I K E  Ltd