Re: SCMP ver 06 posted

> 
> No. We want to have the payload signed by the sending agent's private key, 
> authenticating that she produced the message and allowing us to verify the 
> integrity of the message. Then, we want the sending agent's application to 
> include the request_id, including this in the inner mime headers when the 
> inner MIME message is formed. Once this is done, the inner MIME message is 
> enveloped (encrypted to insure privacy). In accordance with the 
> construction of an SMIME message, this is MIME encapsulated, forming the 
> outer MIME message. The receiving agent's server opens the enveloped inner 
> MIME message using the receiving agent's private key, evaluates the signed 
> payload using the sending agent's private key, and then is ready to process 
> the request.
> 
> Would it help clarify this, if we added some explanation in with the example?
> 
I was irritated by the fact that the SCMP header were not signed at all. 

I think it would help to replace 

> >     [PAYLOAD - signed entity ]

by [SIGNEDPAYLOAD - a SignedData with payload as encapsulatedContent] 


Regards

> 
> 
> >[ OUTER MIME START ]
> >Content-Type: application/pkcs7-mime
> >Content-Transfer-Encoding: base64
> >Content-Length: 1024
> >SCMP-protocol-version: 2.0
> >
> >   [ INNER MIME START - enveloped entity ]
> >   SCMP-request-time-to-live: 90
> >   SCMP-message-type: Commerce/2.0
> >   SCMP-request-id: 0123456789012345678901
> >   Content-Type: application/pkcs7-mime
> >   Content-Transfer-Encoding: base64
> >   Content-Length: 512
> >
> >     [PAYLOAD - signed entity ]
> >
> >   [ INNER MIME END ]
> >[ OUTER MIME END ]
> 
> 
> 
> Thomas A. Arnold
> Chief Technical Officer
> CyberSource Corporation
> 1295 Charleston Road
> Mountain View, CA 94043-1307
> email: [email protected]
> Main: 650.965.6000
> ---------------------------------------------------------------------------
> This Email and any attached files are confidential and may also be
> privileged. It is intended only for the individual or entity to whom
> it is addressed. If you are not the recipient or an authorized agent
> of the recipient, you are hereby notified that any use, dissemination,
> distribution or copying of this communication is strictly prohibited.
> If you have received this message in error, please contact CyberSource
> Corporation immediately at 650.965.6000.
> 
> Thank you.
> 
>