Re: The issue of mime parsing

Rickard:
>> It may be the best solution to use a MIME-like format for
>> [the manifest] file,

clemens:
> could you describe this manifest format, please?

The more I think about it, the more convinced I get that using
MIME-style for the manifest file is not optimal. For something this
simple we should be better of with a dedicated format. Still,
I will try to give a concrete example on what I mean by constructing
a manifest file using a subset of MIME (also inspired by your
ideas about signatures):

===============================================================
From: Alice <[im2000-style address]>
To: Bob <[im2000-style address]>
Date: 26 Mar 2003 12:41:43 +0100
Subject: Example im2000 email
X-im2000-signature: [Some cryptographic signature of everything
            inside this file except dynamically changing delivery
            lines]
MIME-Version: 1.0
Message-ID: <[email protected]>
Content-type: multipart/alternative; boundary="---"

-----
Content-type: message/external-body;
          access-type=local-file;
          name="message.txt"
Content-type: text/plain; charset=us-ascii
Content-ID: <[email protected]>
X-md5-hash: 88f7e6ce759caefa1a8dc18417016d1b

-----
Content-type: message/external-body;
          access-type=local-file;
          name="message.rtx"
Content-type: text/enriched
Content-ID: <[email protected]>
X-md5-hash: 44d9f17facc850fbf7ca4ae2258d8733

-----
==============================================================

Even though parsing this file is simpler than parsing generic MIME
(as there can be much stricter requirements on what is allowed),
to me it seems unnecessarily complicated.

> you could make the manifest be a simple list [...]

Yes, that is another alternative. It could then use some easily
parsed format for ordered fields, not nessecarily using ASCII
(perhaps djb:s netstrings is a good idea) also making it possible to
abandon unnessecary labels, like 'From:', 'To:' ...

> thus every file transmitted as im2000 gets its detached
> signature.

Detached signatures seems like a good idea. I am not a crytography
expert, but maybe it is possible to just keep a crypto signature of
the manifest file? (Or rather: the parts of it that does not get
changed during delivery). If the manifest file includes hashes of all
included parts (such as md5), then messing with the part files should
be "hard"? Or does this somehow severly impact the efficiency of the
crypto signature?

> i think your idea for substituting manifests for MIME is a very
> good one indeed!  :)

Thanks! :)

//Rickard