RE: Re(2) : AS{035}2, MIME {038} X.400

[Colin Robbins <Colin.Robbins@xxxxxxxxxxx>]

   >> We've had some discussion about security in the DALLAS IETF meeting (December 95). We said that it is not possible to gateway security in the current standard state since X.400 makes use of Envelope to store information when MIME uses content. THe only way to acheive end to end security is to encapsulate SMIME or MOSS into an X.400 BP. This may work, but each X.400 UA must have MIME capabilities.

As part of the EEMA Challenge 97 project, we are addressing this issue.

The requirement we started from was that of finding a security mechanism that will traverse mail gateways, so that SMTP users could send secure information to an X.400 user.  To solve (simplify!) the problem, we have focused on the issue of securing message attachment.  This is a justifiable simplification, in a business context, as it is often documents and spreadsheets the business user is concerned about the security of.

Having made this simplification, the problem becomes soluble.

We have defined that the message attachments will be secured using PKCS#7.

When SMTP is used, the PKCS#7 attachment will be encapsulated in a MIME wrapper as defined by the S/MIME standard.  This will produce a fully S/MIME compatible message.

When X.400 is used, two modes will be supported in the Challenge
	File Transfer Body Part
	Bilaterally defined
Whichever mode is chosen, the embedded content will be the PKCS#7 file.

By choosing a common underlying layer - PKCS#7 as the message content, it should be possible for an X.400/SMTP gateway to convert successfully between secured X.400 and S/MIME messages.  

There is no need for the X.400 system to have MIME capabilities.


Colin Robbins

EEMA Challenge Project Manager
Tel: +44 115 952 0583


-----------------------------------------------------------------------------------------------
For more information on the EEMA challenge, contact Colin Robbins, or see
	
	http://www.eema.org/challenge97.html

The EEMA Challenge is being supported by the following organisations:
 
	Utimaco Belgium, University of Salford, BT, ACB Associates, ESAT-COSIC University of dLeuven, ICL	
	DANTE, MaXware, NEXOR, Enterprise Solutions Ltd, INFONET, EuroNewsletters, Software Connection BV	
	NHS, ISOCOR, Control Data, Siemens Nixdorf Informationssysteme AG, JEMA, Lotus	
	Grabowsky Polytechnics BV, The Radicati Group Inc, Worldtalk Corporation, Isode Limited,
	EuroSInet, SYSTEC, Softswitch, Directory Works, Eurosinet,  EEMA, EMA, NTT