problem with auto_hi and other questions

RE: Réf. : RE: Netscape interoperability

Eric,

That is quite possible.  RFC 2459 (Internet X.509 PKI Certificate and CRL
Profile) states: 

   CAs conforming to this profile MUST always encode certificate
   validity dates through the year 2049 as UTCTime; certificate validity
   dates in 2050 or later MUST be encoded as GeneralizedTime.

By the way, Bob Colestock was able to successfully import your PKCS #12 file
(including GeneralizedTime) into MS Outlook.

===========================================
John Pawling, John.Pawling <at> GetronicsGov.com
Getronics Government Solutions, LLC
===========================================

-----Original Message-----
From: eboudreault <at> motus.com [mailto:eboudreault <at> motus.com]
Sent: Tuesday, July 03, 2001 1:39 PM
To: Pawling, John
Cc: imc-sfl <at> imc.org
Subject: Réf. : RE: Netscape interoperability

Mr. Pawling,

Is it possible that Netscape did not recognize GeneralizedTime ????

My certificate in the PFX file that i have sent to you was generated with
GeneralizedTime.  I have try to generate the same crtificate with UTCTime
and Netscape was able to import my certificates and private key in his data
base.

Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************


                    "Pawling, John"

                    <John.Pawling <at> Getroni        Pour :
"'eboudreault <at> motus.com'" <eboudreault <at> motus.com>,                
                    csGov.com>                   imc-sfl <at> imc.org

                                                 cc :

                    29/06/01 10:09               Objet :      RE: Netscape
interoperability                                

Eric,

Bob Colestock was able to successfully import your PKCS #12 file into MS
Outlook.  We will test it with Netscape.  There are differences in the way
that Microsoft and Netscape implemented PKCS #12 (especially in earlier
releases).  We hope to have more info for you later today.

===========================================
John Pawling, John.Pawling <at> GetronicsGov.com
Getronics Government Solutions, LLC
===========================================

-----Original Message-----
From: eboudreault <at> motus.com [mailto:eboudreault <at> motus.com]
Sent: Thursday, June 28, 2001 5:16 PM
To: imc-sfl <at> imc.org
Subject: Netscape interoperability

Hi,

I am in the interoperability tests with Netscape and i have problems to
import my certificates.  They are all in a PKCS-12 file generated by my
library.  The problem is that the browser always pop this message with
Netscape 6.01:  "The certificate and private key already exist on the
security device.".  With older versions (4.x) it crash every time.

Can you help me with that ????

There is the file that i have problems with :  (the password is "eric")

(See attached file: Test_Netscape_1.p12)

Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************

Réf. : RE: Netscape interoperability

Mr. Pawling,

Is it possible that Netscape did not recognize GeneralizedTime ????

My certificate in the PFX file that i have sent to you was generated with
GeneralizedTime.  I have try to generate the same crtificate with UTCTime
and Netscape was able to import my certificates and private key in his data
base.

Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************


                                                                                                                           
                    "Pawling, John"                                                                                        
                    <John.Pawling <at> Getroni        Pour :  "'eboudreault <at> motus.com'" <eboudreault <at> motus.com>,                
                    csGov.com>                   imc-sfl <at> imc.org                                                           
                                                 cc :                                                                      
                    29/06/01 10:09               Objet :      RE: Netscape interoperability                                

Eric,

Bob Colestock was able to successfully import your PKCS #12 file into MS
Outlook.  We will test it with Netscape.  There are differences in the way
that Microsoft and Netscape implemented PKCS #12 (especially in earlier
releases).  We hope to have more info for you later today.

===========================================
John Pawling, John.Pawling <at> GetronicsGov.com
Getronics Government Solutions, LLC
===========================================

-----Original Message-----
From: eboudreault <at> motus.com [mailto:eboudreault <at> motus.com]
Sent: Thursday, June 28, 2001 5:16 PM
To: imc-sfl <at> imc.org
Subject: Netscape interoperability

Hi,

I am in the interoperability tests with Netscape and i have problems to
import my certificates.  They are all in a PKCS-12 file generated by my
library.  The problem is that the browser always pop this message with
Netscape 6.01:  "The certificate and private key already exist on the
security device.".  With older versions (4.x) it crash every time.

Can you help me with that ????

There is the file that i have problems with :  (the password is "eric")

(See attached file: Test_Netscape_1.p12)

Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************

Problem when verifying a signed message without SignerInfo

imc-sfl，

	When I use the  function CSM_MsgToVerify::Verify(pCSMIME) to verify
a signed mail which doesn't include any SignerInfo ( set SetIncludeOrigCertsFlag(0)
when you generate it) mail, I found some flaw, or say bug, in SFL. As I traced into the 
CSM_DataToVerify::Verify[1] function, I found that the program will only do
some empty loop because the condition "if (tmpSI->AccessCerts())" will never be met.
Does this mean that such a mail will never be actually verified?

	My question is: If user A send me a signed mail wich does not contain
any SignerInfo. And fortunately I can obtain A's public key and Signerinfo
from a earlier mail. How can I use his public key to verify the new mail?

Thank you very much.

[1]There are too many funcitons that named Verify. The prototype of the one that
	I referred to is
CSM_DataToVerify::Verify(
    CSMIME          *pCSMIME,              // IN, logged-on Instance list
    CSM_Buffer      *pOriginalEncapContent,// IN, optional content if not in SD
    CSM_MsgCertCrls *pMsgCertCrls,         // IN, Originator(s) certs+++
    CSM_MsgSignerInfos *pMsgSignerInfos)

sincerely

            tuzi
            tuzi <at> 126.com

simple C program

bugs when decoding tampered signed message

imc-sfl，

	SFL will get core dump when decoding some tampered signed message. To 
perform te test, you should generate a single part message first. Open it
with a text editor, find the base64 encoded body, and modify the first 'M'
as 'N', or anything else. Now you can try to decode this tampered mail.
	This will cause the mimetest program to be core dumped. I checked the
core, and put the backtrace info at the end of the mail. The bug occurs
when it tries to create a buffer for the ContentInfoMsg. Core dump is not
a good behavior, I prefer a exception or a return code. Please check
this problem when you have time.
	Thanks very much.

(gdb) bt
#0  CSM_Buffer::Length (this=0x0) at c++/sm_buffer.cpp:149
#1  0xdfdd43e0 in CSM_Buffer::Get (this=0x0, l= <at> 0x8046a1c) at c++/sm_buffer.cpp:393
#2  0xdfdd4908 in CSM_Buffer::ReSet (this=0x8242828, b=<incomplete type>)
    at c++/sm_buffer.cpp:492
#3  0xdfdd37bf in CSM_Buffer::CSM_Buffer (this=0x8242828, b=<incomplete type>)
    at c++/sm_buffer.cpp:115
#4  0x8143fe1 in CSM_ContentInfoMsg::CSM_ContentInfoMsg () at ../include/sm_Report.h:303
#5  0x80b37cf in SM_mimeSinglePart (lpszSDCfgFileName=0x0, pCsmime=0x82354e8, 
    CIData=<incomplete type>, lpszContentFile=0x8046d08 "./tuzi/aaa.eml.cnt", output_flag=1)
    at sm_mimeTest.cpp:1125
#6  0x80aee3a in sm_mimeDecode_Basicmessage (msg=0x8240ef0, 
    lpszINFileName=0x8047324 "./tuzi/aaa.eml", pCsmime=0x82354e8) at sm_mimeTest.cpp:201
#7  0x80ae72f in sm_mimeDecode (lpszINFileName=0x8047324 "./tuzi/aaa.eml", 
    lpszSDCfgFileName=0x8047228 "./tuzi/tuziSMIME.cfg", pCsmime=0x82354e8, output_flag=1, 
    verify_flag=1) at sm_mimeTest.cpp:135
#8  0x80ba462 in SM_AutoHiFunction (pszTestFile=0x8047aad "mimetest.cfg", pCSMIME=0x82354e8, 
    pszTestSection=0x80477c8 "auto_hi", output_flag=1, verify_flag=true, lCAPI=0)
    at sm_Autohif.cpp:517
#9  0x80b7aaa in main (argc=2, argv=0x8047958) at sm_Autohi.cpp:186

sincerely

            tuzi
            tuzi <at> 126.com

RE: Problem when verifying a signed message without SignerInfo

Tuzi:

I am not sure what you are trying to do, but you CANNOT take a SignerInfo
from a previous message and verify the present message.  You can take the
certificate from a previous message and use it on the current message's
SignerInfo.

I will assume you intend to verify an existing SignerInfo, but the signing
certificate was not in the SignedData.  In this case, the SFL code behaves
as intended,  the PreProc(...) operation decodes the message, then the
calling application calls Verify(...).  In this case, it is up to the
application to determine that the public key is missing and provide it.
There in an example of such a check in the CL_MsgToVerify::Check(...) method
(in ./SMIME/testsrc/util/CL_MsgToVerify.cpp).  It is up to the application
to retrieve the key on demand and store it in the appropriate matching
SignerInfo (based on SID).  When this extra step is performed, then the
check you mention below will succeed.  If there are no certificates
available, the verify operation cannot proceed.

If this example code is not clear enough, please e-mail back and I will
extract the few statements necessary to check, then load a certificate to
the appropriate SignerInfo.

Bob Colestock
VDA

-----Original Message-----
From: tuzi [mailto:tuzi <at> 126.com]
Sent: Thursday, July 05, 2001 5:40 AM
To: imc-sfl <at> imc.org
Subject: Problem when verifying a signed message without SignerInfo

imc-sfl，

	When I use the  function CSM_MsgToVerify::Verify(pCSMIME) to verify
a signed mail which doesn't include any SignerInfo ( set
SetIncludeOrigCertsFlag(0)
when you generate it) mail, I found some flaw, or say bug, in SFL. As I
traced into the 
CSM_DataToVerify::Verify[1] function, I found that the program will only do
some empty loop because the condition "if (tmpSI->AccessCerts())" will never
be met.
Does this mean that such a mail will never be actually verified?

	My question is: If user A send me a signed mail wich does not
contain
any SignerInfo. And fortunately I can obtain A's public key and Signerinfo
from a earlier mail. How can I use his public key to verify the new mail?

Thank you very much.

[1]There are too many funcitons that named Verify. The prototype of the one
that
	I referred to is
CSM_DataToVerify::Verify(
    CSMIME          *pCSMIME,              // IN, logged-on Instance list
    CSM_Buffer      *pOriginalEncapContent,// IN, optional content if not in
SD
    CSM_MsgCertCrls *pMsgCertCrls,         // IN, Originator(s) certs+++
    CSM_MsgSignerInfos *pMsgSignerInfos)

sincerely

            tuzi
            tuzi <at> 126.com

CSM_Free3::SMTI_DigestData

Hi,

I want to know why we do not use CryptoPP::SHA when we want to do hash with
SHA algorithm ?????   (we use internal function)

/***************************************************************************************/

(line 2134)
//////////////////////////////////////////////////////////////////////////
// SMTI_DigestData uses CSM_Common for SHA1 and Crypto++ for MD5
SM_RET_VAL CSM_Free3::SMTI_DigestData(
            CSM_Buffer *pData, // input
            CSM_Buffer *pDigest) // output
{
   CSM_OID *poidDigest = NULL;
   char *pchData;
   long lBytesRead;

   SME_SETUP("CSM_Free3::SMTI_DigestData");

   // find out what the preferred digest alg is
   if ((poidDigest = GetPrefDigest()) == NULL)
      SME_THROW(SM_FREE_NO_DIGEST_ALG, NULL, NULL);

   if (*poidDigest == sha_1 || *poidDigest == id_dsa_with_sha1 ||
//       *poidDigest == sha_1WithRSAEncryption_ALT ||
       *poidDigest == sha_1WithRSAEncryption)
   {
      // do SHA1 digest using common CTI
      SME(CSM_Common::SMTI_DigestData(pData, pDigest));
   }
   else if (*poidDigest == md5 ||
            *poidDigest == md5WithRSAEncryption)
   {
      bool bLastBlock = false; // set to true when this is the last block
      // do MD5 digest
      MD5 md5;
....
}
/***************************************************************************************/

CSM_Free3 is not supposed to use Crypto++ library ?????

Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************

RE: CSM_Free3::SMTI_DigestData

Eric:

This version was already tested with our software; it is un-encumbered (no
licensing issues); it works...

You are certainly welcome to use the internal version if you wish, it should
work the same.  As provided in the SFL, the SHA-1 and SHA-2 hashes are
currently available without a CTIL.

Bob Colestock
VDA.

-----Original Message-----
From: eboudreault <at> motus.com [mailto:eboudreault <at> motus.com]
Sent: Tuesday, July 10, 2001 8:58 AM
To: imc-sfl <at> imc.org
Subject: CSM_Free3::SMTI_DigestData

Hi,

I want to know why we do not use CryptoPP::SHA when we want to do hash with
SHA algorithm ?????   (we use internal function)

/***************************************************************************
************/

(line 2134)
//////////////////////////////////////////////////////////////////////////
// SMTI_DigestData uses CSM_Common for SHA1 and Crypto++ for MD5
SM_RET_VAL CSM_Free3::SMTI_DigestData(
            CSM_Buffer *pData, // input
            CSM_Buffer *pDigest) // output
{
   CSM_OID *poidDigest = NULL;
   char *pchData;
   long lBytesRead;

   SME_SETUP("CSM_Free3::SMTI_DigestData");

   // find out what the preferred digest alg is
   if ((poidDigest = GetPrefDigest()) == NULL)
      SME_THROW(SM_FREE_NO_DIGEST_ALG, NULL, NULL);

   if (*poidDigest == sha_1 || *poidDigest == id_dsa_with_sha1 ||
//       *poidDigest == sha_1WithRSAEncryption_ALT ||
       *poidDigest == sha_1WithRSAEncryption)
   {
      // do SHA1 digest using common CTI
      SME(CSM_Common::SMTI_DigestData(pData, pDigest));
   }
   else if (*poidDigest == md5 ||
            *poidDigest == md5WithRSAEncryption)
   {
      bool bLastBlock = false; // set to true when this is the last block
      // do MD5 digest
      MD5 md5;
....
}
/***************************************************************************
************/

CSM_Free3 is not supposed to use Crypto++ library ?????

Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************

CSM_Free3::GeneratePBEKey

Hi,

I want to know if this function is supposed to be compatible with PKCS-5
????

If yes, it have a small bug.

This the code now :

CSM_Buffer* CSM_Free3::GeneratePBEKey(CSM_Buffer *pbufSalt, int nIterCount,
                                     char *pszPassword)
{
.....
   CSM_OID o(md5);
.....
   int temp = strlen(pszPassword);;
   if (temp > (16)) //pbufSalt->Length()))
      temp = 16; //pbufSalt->Length();
   SME(pK->Write(pszPassword, temp));
   if (16-temp > 0)
   {
      SME(pK->Write(pbufSalt->Access(),
         16-temp)); //pbufSalt->Length()))
   }
    //  SME(pK->Write(pbufSalt->Access(),
        // )); //pbufSalt->Length()));

#ifdef NODEF
   SME(pK->Write(pszPassword, strlen(pszPassword)));
   SME(pK->Write(pbufSalt->Access(),
         pbufSalt->Length()));
#endif
.....
   // at this point, pK has the key, delete Temp
   delete (pTemp);
.....
}

There is the correction :

CSM_Buffer* CSM_Free3::GeneratePBEKey(CSM_Buffer *pbufSalt, int nIterCount,
char *pszPassword, AsnOid hashOid, int nKeyLength)
{
     .....
     CSM_OID o(hashOid);
     .....
     if ( o == md5)
          if (nKeyLength > 16)
               SME_THROW(???????????);
     else if (0 = sha1)
          if (nKeyLength > 20)
               SME_THROW(???????????);
     else
          SME_THROW(???????????);

     int temp = strlen(pszPassword);
     SME(pK->Write(pszPassword, temp));
     SME(pK->Write(pbufSalt->Access(), pbufSalt->Length()));
     .....
     if (pTemp)
          delete (pTemp);
     pTemp = new CSM_Buffer();
     pTemp->Set(pK->Access(), nKeyLength);
     pK = pTemp;
     .....
}

Thanks.
**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: eboudreault <at> motus.com
**************************************************************************