Subject: [lamps] Comment on "backward compatibility" section of draft-housley-lamps-cms-update-alg-id-protect

From: "Salz, Rich" <[email-masked]>
Date: Tue, 21 Jan 2020 19:12:25 +0000

Responding to https://tools.ietf.org/html/draft-housley-lamps-cms-update-alg-id-protect-00#section-3.4

OpenSSL includes a CMS API and command-line program.  The command-line program does NOT allow different digests to be used for content and signed attributes, and nobody seems to have ever requested support for it.  While I haven’t followed the API all the way through, it seems that the API doesn’t allow this either as it only associates one “X.509” signing object per CMS object.