Subject: [Simple] MSRP Security Review: RFC3862 Application Considerations

From: Ben Campbell <[email-masked]>
Date: Thu, 9 Sep 2004 21:21:36 -0500

Hi,

Sam's security review pointed out that we had not handled the 
application considerations required by RFC3862 on all applications 
using the message/cpim MIME type. Here is a first cut at those 
considerations for discussion (quoted text from RFC3862)

>   Applications using this specification must also specify:
>
>    o  all headers that must be recognized by implementations of the
>       application

All MSRP endpoints MUST recognize the From, To, DateTime, and Require 
headers as defined in RFC3862. Such applications SHOULD recognize the 
CC header, and MAY recognize the Subject header. Any MSRP application 
that recognizes any message/cpim header MUST understand the NS (name 
space) header.

>
>    o  any headers that must be present in all messages created by that
>       application.

All message/cpim body parts send by an MSRP endpoint MUST include the 
 From and To headers. If the message/cpim body part is protected using 
S/MIME, then it SHOULD also include the DateTime header.

>
>    o  any headers that may appear more than once in a message, and how
>       they are to be interpreted (e.g., how to interpret multiple
>       'Subject:' headers with different language parameter values).
>

Message/cpim headers defined in RFC 3862, with the exception of the NS 
header, MUST NOT occur more than once in a given message/cpim body part 
in an MSRP message. The Require header MAY include multiple values. The 
NS header MAY occur zero or more times, depending on how many name 
spaces are being referenced.

Extension headers MAY occur more than once, depending on the definition 
of such headers.

>    o  Security mechanisms and crytography schemes to be used with the
>       application, including any mandatory-to-implement security
>       provisions.

[Ben: I _think_ we are covering this in general--do we need to 
explicitly relate such mechanisms to message/cpim?]

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple