Subject: RE: [Simple] MSRP Security Review: RFC3862 Application Considerations

From: [email-masked]
Date: Fri, 10 Sep 2004 18:55:02 +0300

> -----Original Message-----
> From: ext Paul Kyzivat [mailto:[email-masked]]
> Sent: 10.September.2004 16:26
> To: Khartabil Hisham (Nokia-TP-MSW/Helsinki)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Simple] MSRP Security Review: RFC3862 Application
> Considerations
> 
> 
> Hisham,
> 
> I agree with most of your comments, but I question the logic 
> of multiple 
> Subject headers. What does this mean? Is the actual subject the 
> catenation of the contents of all the Subject headers? Should 
> they have 
> <CR><LF> between then when displayed? Or are they to be treated as 
> alternatives, such as the same subject represented in 
> different languages?

That's what I had in mind.

/Hisham

> 
> I believe 3261 only allows one Subject header. I don't know 
> about email, 
> but by common usage I don't think it would work well if there 
> was more 
> than one.
> 
> 	Paul
> 
> [email-masked] wrote:
> > 
> >>-----Original Message-----
> >>From: [email-masked] 
> >>[mailto:[email-masked]]On Behalf
> >>Of ext Ben Campbell
> >>Sent: 10.September.2004 05:22
> >>To: Simple WG
> >>Subject: [Simple] MSRP Security Review: RFC3862 Application
> >>Considerations
> >>
> >>
> >>Hi,
> >>
> >>Sam's security review pointed out that we had not handled the 
> >>application considerations required by RFC3862 on all applications 
> >>using the message/cpim MIME type. Here is a first cut at those 
> >>considerations for discussion (quoted text from RFC3862)
> >>
> >>
> >>>  Applications using this specification must also specify:
> >>>
> >>>   o  all headers that must be recognized by implementations of the
> >>>      application
> >>
> >>All MSRP endpoints MUST recognize the From, To, DateTime, 
> and Require 
> >>headers as defined in RFC3862. Such applications SHOULD 
> recognize the 
> >>CC header, and MAY recognize the Subject header. Any MSRP 
> application 
> >>that recognizes any message/cpim header MUST understand the 
> NS (name 
> >>space) header.
> >>
> >>
> >>>   o  any headers that must be present in all messages 
> >>
> >>created by that
> >>
> >>>      application.
> >>
> >>All message/cpim body parts send by an MSRP endpoint MUST 
> include the 
> >> From and To headers. If the message/cpim body part is 
> >>protected using 
> >>S/MIME, then it SHOULD also include the DateTime header.
> >>
> >>
> >>>   o  any headers that may appear more than once in a 
> >>
> >>message, and how
> >>
> >>>      they are to be interpreted (e.g., how to interpret multiple
> >>>      'Subject:' headers with different language parameter values).
> >>>
> >>
> >>Message/cpim headers defined in RFC 3862, with the exception 
> >>of the NS 
> >>header, MUST NOT occur more than once in a given message/cpim 
> >>body part 
> >>in an MSRP message. The Require header MAY include multiple 
> >>values. The 
> >>NS header MAY occur zero or more times, depending on how many name 
> >>spaces are being referenced.
> >>
> >>Extension headers MAY occur more than once, depending on the 
> >>definition 
> >>of such headers.
> > 
> > 
> > The To-header field should not be limited to 1, nor should 
> the CC field. This could be used in the future for, what is 
> commonly referred to as, whispering or private messages 
> within a conference.
> > 
> > Also, the subject header might appear multiple times. I 
> would say we limit the from-header to one and no limit on the rest.
> > 
> > Regards,
> > Hisham
> > 
> > 
> >>>   o  Security mechanisms and crytography schemes to be 
> >>
> >>used with the
> >>
> >>>      application, including any mandatory-to-implement security
> >>>      provisions.
> >>
> >>[Ben: I _think_ we are covering this in general--do we need to 
> >>explicitly relate such mechanisms to message/cpim?]
> >>
> >>
> >>_______________________________________________
> >>Simple mailing list
> >>[email-masked]
> >>https://www1.ietf.org/mailman/listinfo/simple
> >>
> > 
> > 
> > _______________________________________________
> > Simple mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/simple
> > 
> 
> 

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 21 Sep 2004 11:41:50 -0700

Seem to me that multiple To, Subject, Foo etc in CPIM is not an issues for
MSRP - MSRP caries CPIM - headers in CPIM mean what CPIM says they mean. My
vague read of 3862 is that there can me one From , multiple To, multiple cc,
one DateTime, and is though it is unclear on Subject, I would read it as
only one Subject since the things that are multiple it explicitly mentions
as such.