Re: SCMP ver 06 posted

At 03:45 PM 5/31/00 +0200, you wrote:
> >
>[snip]
>the question was whether the SCMP-request-id is signed or not?

the request ID is in the inner MIME message and is enveloped.

the payload is signed. If there's a section of the text that is not clear, 
we need to fix it. Section 2 describes the message construction correctly 
and is consistent with the example. In essence, the payload is signed, then 
MIME encapsulated, forming the inner MIME message. This inner MIME message 
is enveloped (encrypted), then MIME encapsulated, forming the outer MIME 
message.


>The text and the example is not clear to me:
>Do you first encapsulate and then sign or the other way around?
>
>You example puts first a 'signed entity' and around it an
>'enveloped entity'. This doesn't seem to correspond to the
>text of the outer/inner construction.
>
>Do you actualy want to first encrypt the payload, and then
>add a signature around with the SCMP headers?

No. We want to have the payload signed by the sending agent's private key, 
authenticating that she produced the message and allowing us to verify the 
integrity of the message. Then, we want the sending agent's application to 
include the request_id, including this in the inner mime headers when the 
inner MIME message is formed. Once this is done, the inner MIME message is 
enveloped (encrypted to insure privacy). In accordance with the 
construction of an SMIME message, this is MIME encapsulated, forming the 
outer MIME message. The receiving agent's server opens the enveloped inner 
MIME message using the receiving agent's private key, evaluates the signed 
payload using the sending agent's private key, and then is ready to process 
the request.

Would it help clarify this, if we added some explanation in with the example?



>[ OUTER MIME START ]
>Content-Type: application/pkcs7-mime
>Content-Transfer-Encoding: base64
>Content-Length: 1024
>SCMP-protocol-version: 2.0
>
>   [ INNER MIME START - enveloped entity ]
>   SCMP-request-time-to-live: 90
>   SCMP-message-type: Commerce/2.0
>   SCMP-request-id: 0123456789012345678901
>   Content-Type: application/pkcs7-mime
>   Content-Transfer-Encoding: base64
>   Content-Length: 512
>
>     [PAYLOAD - signed entity ]
>
>   [ INNER MIME END ]
>[ OUTER MIME END ]



Thomas A. Arnold
Chief Technical Officer
CyberSource Corporation
1295 Charleston Road
Mountain View, CA 94043-1307
email: [email protected]
Main: 650.965.6000
---------------------------------------------------------------------------
This Email and any attached files are confidential and may also be
privileged. It is intended only for the individual or entity to whom
it is addressed. If you are not the recipient or an authorized agent
of the recipient, you are hereby notified that any use, dissemination,
distribution or copying of this communication is strictly prohibited.
If you have received this message in error, please contact CyberSource
Corporation immediately at 650.965.6000.

Thank you.