5 ms·

S/MIME Version 4.0 Message Specification

69 points by okket 7y ago

ianlevesque 7y ago
This section describes the changes made between S/MIME v3.2 and S/MIME v4.0. - Added the use of AuthEnvelopedData, including defining and registering an smime-type value (Sections 2.4.4 and 3.4). - Updated the content-encryption algorithms (Sections 2.7 and 2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added ChaCha20-Poly1305, removed mention of AES-192 Cipher Block Chaining (CBC), and marked tripleDES as historic. - Updated the set of signature algorithms (Section 2.2): added the Edwards-curve Digital Signature Algorithm (EdDSA), added the Elliptic Curve Digital Signature Algorithm (ECDSA), and marked DSA as historic. - Updated the set of digest algorithms (Section 2.1): added SHA-512, and marked SHA-1 as historic. - Updated the size of keys to be used for RSA encryption and RSA signing (Section 4). - Created Appendix B, which discusses considerations for dealing with historic email messages.
- ChrisSD 7y ago
  Formatting note: using code blocks for list works horribly on mobile.
  - bo1024 7y ago
    and desktop!
  - microcolonel 7y ago
    The original document is preformatted monospace text, so a preformatted block is the only way to display it without a lot of effort to rejoin the lines and separate them into paragraph breaks (so that HN won't combine them inappropriately).
    - ChrisSD 7y ago
      Fair enough, but if I simply copy and paste the above without indents it doesn't look so bad: - Added the use of AuthEnvelopedData, including defining and registering an smime-type value (Sections 2.4.4 and 3.4). - Updated the content-encryption algorithms (Sections 2.7 and 2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added ChaCha20-Poly1305, removed mention of AES-192 Cipher Block Chaining (CBC), and marked tripleDES as historic. - Updated the set of signature algorithms (Section 2.2): added the Edwards-curve Digital Signature Algorithm (EdDSA), added the Elliptic Curve Digital Signature Algorithm (ECDSA), and marked DSA as historic. - Updated the set of digest algorithms (Section 2.1): added SHA-512, and marked SHA-1 as historic. - Updated the size of keys to be used for RSA encryption and RSA signing (Section 4). - Created Appendix B, which discusses considerations for dealing with historic email messages.
      - Ettvatre 7y ago
        Yes this is actually readable.
    - euyyn 7y ago
      No need to rejoin the lines, as HN will combine them as you say. Only need to add a new line before each bullet point.
    - parliament32 7y ago
      >a lot of effort Just ':%s/\n\s//g' in vim... substitute (newline + non-ws char) with nothing.
  - Avamander 7y ago
    This is what we get for tolerating hard wraps. Same issue with git commit messages.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
sara1736 7y ago
World's biggest cat Even you can't believe it's size See her video https://howto105.blogspot.com/2019/04/worlds-biggest-cat.html https://howto105.blogspot.com/2019/04/worlds-biggest-cat.htm... See the video a dog shopping and lots of other acts like humans http://bit.ly/2DCpo9I http://bit.ly/2DCpo9I Even you can't believe there is a hen in world's biggest animals See the video how they looks and what they do https://cutt.ly/1rOU7Q https://cutt.ly/1rOU7Q Fish walking with legs like humans See the video on link below http://bit.ly/2XRGyYD http://bit.ly/2XRGyYD This couple is different Girls are both twins and boys are also twin brothers see how they look in video http://bit.ly/2VwoZQd http://bit.ly/2VwoZQd A cute dog is dancing in video Just watch this video and try to control your laugh http://bit.ly/2ZK1XVs http://bit.ly/2ZK1XVs
lol768 7y ago
Nice to see AES GCM & ChaCha20-Poly1305 in there. Seems to generally be moving in a good direction. Now we just need a CA that will offer free S/MIME capable certificates in a space that is rapidly shrinking (Sectigo have recently removed their offering... I think Actalis is now the only CA in this area that's trusted. Let's Encrypt, will you step up to the mark?
- kevingrahl 7y ago
  Let’s Encrypt has said multiple times that they will not offer S/MIME certificates.
  - yardstick 7y ago
    Is there a specific reason they have given for not supporting it? I’m a PGP fan myself but S/MIME is still useful. I’ve found https://community.letsencrypt.org/t/s-mime-certificates/153 https://community.letsencrypt.org/t/s-mime-certificates/153 which seems to imply that it’s because they can’t validate emails securely enough in— although the comment wasn’t from LE staff. Maybe because email certs should last longer than a few months so it wouldn’t be as useful? I’m curious now!
    - kevingrahl 7y ago
      Search the forum. If I remember correctly it’s about validation and scalability. I don’t believe they ever gave a good reason not to.
    - hannob 7y ago
      HTTPS is a mass feature and LE saw a need to make this available for free and with easier deployment and automation. And if implemented with state of the art technology it's a very robust and secure technology. S/MIME is super niche. Even within the niche of email encryption it's a niche protocol. Also it suffers from loads of security problems and this RFC covers only a small fraction of them (and doesn't do a very good job due to backwards compatibility - it still has a "MUST support" the broken CBC modes).

69 points by okket 7y ago

This section describes the changes made between S/MIME v3.2 and S/MIME v4.0. - Added the use of AuthEnvelopedData, including defining and registering an smime-type value (Sections 2.4.4 and 3.4). - Updated the content-encryption algorithms (Sections 2.7 and 2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added ChaCha20-Poly1305, removed mention of AES-192 Cipher Block Chaining (CBC), and marked tripleDES as historic. - Updated the set of signature algorithms (Section 2.2): added the Edwards-curve Digital Signature Algorithm (EdDSA), added the Elliptic Curve Digital Signature Algorithm (ECDSA), and marked DSA as historic. - Updated the set of digest algorithms (Section 2.1): added SHA-512, and marked SHA-1 as historic. - Updated the size of keys to be used for RSA encryption and RSA signing (Section 4). - Created Appendix B, which discusses considerations for dealing with historic email messages.

ChrisSD 7y ago
Formatting note: using code blocks for list works horribly on mobile.
- bo1024 7y ago
  and desktop!
- microcolonel 7y ago
  The original document is preformatted monospace text, so a preformatted block is the only way to display it without a lot of effort to rejoin the lines and separate them into paragraph breaks (so that HN won't combine them inappropriately).
  - ChrisSD 7y ago
    Fair enough, but if I simply copy and paste the above without indents it doesn't look so bad: - Added the use of AuthEnvelopedData, including defining and registering an smime-type value (Sections 2.4.4 and 3.4). - Updated the content-encryption algorithms (Sections 2.7 and 2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added ChaCha20-Poly1305, removed mention of AES-192 Cipher Block Chaining (CBC), and marked tripleDES as historic. - Updated the set of signature algorithms (Section 2.2): added the Edwards-curve Digital Signature Algorithm (EdDSA), added the Elliptic Curve Digital Signature Algorithm (ECDSA), and marked DSA as historic. - Updated the set of digest algorithms (Section 2.1): added SHA-512, and marked SHA-1 as historic. - Updated the size of keys to be used for RSA encryption and RSA signing (Section 4). - Created Appendix B, which discusses considerations for dealing with historic email messages.
    - Ettvatre 7y ago
      Yes this is actually readable.
  - euyyn 7y ago
    No need to rejoin the lines, as HN will combine them as you say. Only need to add a new line before each bullet point.
  - parliament32 7y ago
    >a lot of effort Just ':%s/\n\s//g' in vim... substitute (newline + non-ws char) with nothing.
- Avamander 7y ago
  This is what we get for tolerating hard wraps. Same issue with git commit messages.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

sara1736 7y ago

World's biggest cat Even you can't believe it's size See her video https://howto105.blogspot.com/2019/04/worlds-biggest-cat.html https://howto105.blogspot.com/2019/04/worlds-biggest-cat.htm... See the video a dog shopping and lots of other acts like humans http://bit.ly/2DCpo9I http://bit.ly/2DCpo9I Even you can't believe there is a hen in world's biggest animals See the video how they looks and what they do https://cutt.ly/1rOU7Q https://cutt.ly/1rOU7Q Fish walking with legs like humans See the video on link below http://bit.ly/2XRGyYD http://bit.ly/2XRGyYD This couple is different Girls are both twins and boys are also twin brothers see how they look in video http://bit.ly/2VwoZQd http://bit.ly/2VwoZQd A cute dog is dancing in video Just watch this video and try to control your laugh http://bit.ly/2ZK1XVs http://bit.ly/2ZK1XVs

lol768 7y ago

Nice to see AES GCM & ChaCha20-Poly1305 in there. Seems to generally be moving in a good direction. Now we just need a CA that will offer free S/MIME capable certificates in a space that is rapidly shrinking (Sectigo have recently removed their offering... I think Actalis is now the only CA in this area that's trusted. Let's Encrypt, will you step up to the mark?

kevingrahl 7y ago
Let’s Encrypt has said multiple times that they will not offer S/MIME certificates.
- yardstick 7y ago
  Is there a specific reason they have given for not supporting it? I’m a PGP fan myself but S/MIME is still useful. I’ve found https://community.letsencrypt.org/t/s-mime-certificates/153 https://community.letsencrypt.org/t/s-mime-certificates/153 which seems to imply that it’s because they can’t validate emails securely enough in— although the comment wasn’t from LE staff. Maybe because email certs should last longer than a few months so it wouldn’t be as useful? I’m curious now!
  - kevingrahl 7y ago
    Search the forum. If I remember correctly it’s about validation and scalability. I don’t believe they ever gave a good reason not to.
  - hannob 7y ago
    HTTPS is a mass feature and LE saw a need to make this available for free and with easier deployment and automation. And if implemented with state of the art technology it's a very robust and secure technology. S/MIME is super niche. Even within the niche of email encryption it's a niche protocol. Also it suffers from loads of security problems and this RFC covers only a small fraction of them (and doesn't do a very good job due to backwards compatibility - it still has a "MUST support" the broken CBC modes).