Netscape Navigator 2.0 will implement secure e-mail

I just got off of Netscapes home page and they have announced Netscape
Navigator 2.0. It will include full e-mail funtionality with S/MIME
implemented.  Does anybody know anything about the S/MIME Protocol?
How secure is it?



Dan Weinstein
danjw@earthlink.net
http://www.earthlink.net/~danjw
PGP public key is available from my Home Page.

"I understand by 'freedom of Spirit' something quite difinite -
the unconditional will to say No, where it is dangerous to say
No.        
           Friedrich Nietzsche

In article <199509180727.AAA23196@atlas.earthlink.net>, danjw@earthlink.net (Dan Weinstein) writes:
> I just got off of Netscapes home page and they have announced Netscape
> Navigator 2.0. It will include full e-mail funtionality with S/MIME
> implemented.  Does anybody know anything about the S/MIME Protocol?
> How secure is it?

  You can find some documents about s/mime on RSA's web site:

	http://www.rsa.com/ftpdir/pub/S-MIME/

S/MIME is basicly a mime body enveloped in a PKCS7 message.  You can
find out more about PKCS from:

	http://www.rsa.com/ftpdir/pub/pkcs

The implementation guide recommends using rc2-cbc 40-bit for content
encryption when there is no way to determine the capabilities of the
recipient.  When you do know what the recipient can do, it recommends
using RC2-CBC with a longer key or DES-CBC.

For key encryption support for RSA with key sizes of 512 to 1024 is
required, and support for 2048 bit keys is recommended.  A minimum
key size of 768 bits is recommended for US users.

> Dan Weinstein

  Hi Dan.  Yes, we are related.  :-)

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

On 18 Sep 1995, Jeff Weinstein wrote:
> The implementation guide recommends using rc2-cbc 40-bit for content
> encryption when there is no way to determine the capabilities of the
> recipient.  When you do know what the recipient can do, it recommends
> using RC2-CBC with a longer key or DES-CBC.

Hmm....  notice the use of a non public cipher as the base cipher.... 
what a shame.... 

A note for non-USA people, the next version of SSLeay will include the 
full fuctionality of RSAref/RSAeuro and I should soon have the PKCS-7 
stuff finished in the next release after that.  I've almost finished the 
documentation of the encryption/RSA type routines. The encryption/open/seal 
routines supporting any cipher that conforms with a specified Cipher API.

It will be shipping with examples of des-ecb, des-cfb, des-cbc, des-ede2, 
des-ede3, idea-ecb, idea-cfb, idea-cbc and rc4-128.  If people could send 
me the official Object identifiers for these ciphers, I'll be able to 
support them in PKCS-7, otherwise they will only be supported in PEM mode.
eg,
rc4 is '1 2 840 113549 3 4'
but I don't even know what des in cbc mode is.  I lack documentation.
If any-one can email SMIME/PKCS-7 stuff that is encrypted/sealed, I'll be 
able to extract the object identifiers.


> For key encryption support for RSA with key sizes of 512 to 1024 is
> required, and support for 2048 bit keys is recommended.  A minimum
> key size of 768 bits is recommended for US users.

Again, SSLeay has no restrictions, 4096 bits anyone :-)

eric (who is just lacking documentation :-(
--
Eric Young                  | Signature removed since it was generating
AARNet: eay@mincom.oz.au    | more followups than the message contents :-)

Eric Young writes:
> On 18 Sep 1995, Jeff Weinstein wrote:
> > The implementation guide recommends using rc2-cbc 40-bit for content
> > encryption when there is no way to determine the capabilities of the
> > recipient.  When you do know what the recipient can do, it recommends
> > using RC2-CBC with a longer key or DES-CBC.
> 
> Hmm....  notice the use of a non public cipher as the base cipher.... 
> what a shame.... 

Its also a shame that they aren't sticking to MOSS, which is the open
IETF standard for such stuff.

Perry

In article <Pine.SOL.3.91.950918185301.29263B-100000@orb>, eay@mincom.oz.au (Eric Young) writes:
> Hmm....  notice the use of a non public cipher as the base cipher.... 
> what a shame.... 

  The only reason for this is US export laws.

> It will be shipping with examples of des-ecb, des-cfb, des-cbc, des-ede2, 
> des-ede3, idea-ecb, idea-cfb, idea-cbc and rc4-128.  If people could send 
> me the official Object identifiers for these ciphers, I'll be able to 
> support them in PKCS-7, otherwise they will only be supported in PEM mode.

  Here are the ones I have:

     DES-ECB OBJECT IDENTIFIER ::= { algorithm 6 } 
     DES-CBC OBJECT IDENTIFIER ::= { algorithm 7 } 
     DES-OFB OBJECT IDENTIFIER ::= { algorithm 8 } 
     DES-CFB OBJECT IDENTIFIER ::= { algorithm 9 } 
     DES-MAC OBJECT IDENTIFIER ::= { algorithm 10 } 
     DES-EDE OBJECT IDENTIFIER ::= { algorithm 17 }

     where 

     algorithm OBJECT IDENTIFIER ::=  
       {iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2)}


	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.