RE: RE: Problem verifying a signed message

Manfred:

You have been busy!

Thank you for your thorough investigation.  I was not aware of the other
packages using the older ASN.1 SET OF sorting rules.  Rich (here)
inidicated that this SET OF sort rule was changed relatively recently;
our SFL strictly uses the new rules, hence the broken verification.
This also explains why some of the examples document messages fail our
verification process (even the ones we generated previously); I had
forgotten about this recent update to the SNACC DER encoding rules.

I performed some tests using messages generated with the SFL (MIME).
All of my messages verify using MS Outlook.  I checked the actual ASN.1
encoding and found that the new ANS.1 SET OF sort encoding was used
appropriately by our SFL library.  This indicates that MS Outlook (and
Express) probably takes the actual binary SignedAttrs from the
SignerInfo of the message for the signature verification, not a
re-encoded binary as we do (or it handles both encoding rules).  Based
on this, I will investigate modifying the SFL libraries to accommodate
both the DER rule verification and if this fails, then take the original
binary encoding fo verification before indicating a failure to the user.
Basically, I will fix our library to accommodate both cases as MS
Outlook appears to be doing.

I thank you again for bringing this to our attention, it is good to fix
the library for this case.  I should be getting back to you as soon as I
can (working on it now).

Bob Colestock


-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Tuesday, March 19, 2002 6:12 AM
To: [email protected]
Subject: Re: RE: Problem verifying a signed message



I Have done some tests and have found the following:

SFL can't verify messages from Mozilla 0.9.8, Netscape 4.79 and Outlook
Express 5.00.2919.6600

After that I have picked up an example from the draft ietf smime
examples (http://www.imc.org/draft-ietf-smime-examples examples 5.4 and
11.2) and found that I can't verify this examples too.

In all cases the verify works if I change the order of the
signedAttributes manually so that they include the length field for
sorting.

Any comment would be greatly appreciated.

Thanks,

Manfred Klug


________________________________________________________________
Keine verlorenen Lotto-Quittungen, keine vergessenen Gewinne mehr! 
Beim WEB.DE Lottoservice: http://tippen2.web.de/?x=13