Skip to main content
Information Security

Return to Question

Notice removed Draw attention by makerofthings7
Bounty Ended with Thomas Pornin's answer chosen by makerofthings7
Tweeted twitter.com/#!/StackSecurity/status/572636847551188992
Notice added Draw attention by makerofthings7
Bounty Started worth 100 reputation by makerofthings7
added 149 characters in body
Source Link
makerofthings7
makerofthings7
  • 51.1k
  • 56
  • 268
  • 562

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature.

Then sometime in July I need to revoke that certificate.

My goal is to not invalidate all prior emails signed with that key, but, rather give recipients some assurance that the key was valid and correct when they received the message. CMS/PKCS7 might do what I'm needing IF:

  • The sending client includes the revocation response in the message
  • The signing PKI infrastructure is correct and not flawed
  • The validator will see the SMIME signature, validate it, and also validate the signature as well.
  • Does this whole concept fall apart if when the certificate is expired/superseded and not lost due to theft/loss of integrity of the private key?

Given the inconsistent support for SMIME (e.g. gmail and all things Google) is there any software or technology that would validate in the way that solves my needs?

Is what I'm looking for viable, or am I using the wrong technology for the wrong purpose?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature.

Then sometime in July I need to revoke that certificate.

My goal is to not invalidate all prior emails signed with that key, but, rather give recipients some assurance that the key was valid and correct when they received the message. CMS/PKCS7 might do what I'm needing IF:

  • The sending client includes the revocation response in the message
  • The signing PKI infrastructure is correct and not flawed
  • The validator will see the SMIME signature, validate it, and also validate the signature as well.

Given the inconsistent support for SMIME (e.g. gmail and all things Google) is there any software or technology that would validate in the way that solves my needs?

Is what I'm looking for viable, or am I using the wrong technology for the wrong purpose?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature.

Then sometime in July I need to revoke that certificate.

My goal is to not invalidate all prior emails signed with that key, but, rather give recipients some assurance that the key was valid and correct when they received the message. CMS/PKCS7 might do what I'm needing IF:

  • The sending client includes the revocation response in the message
  • The signing PKI infrastructure is correct and not flawed
  • The validator will see the SMIME signature, validate it, and also validate the signature as well.
  • Does this whole concept fall apart if when the certificate is expired/superseded and not lost due to theft/loss of integrity of the private key?

Given the inconsistent support for SMIME (e.g. gmail and all things Google) is there any software or technology that would validate in the way that solves my needs?

Is what I'm looking for viable, or am I using the wrong technology for the wrong purpose?

Source Link
makerofthings7
makerofthings7
  • 51.1k
  • 56
  • 268
  • 562

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature.

Then sometime in July I need to revoke that certificate.

My goal is to not invalidate all prior emails signed with that key, but, rather give recipients some assurance that the key was valid and correct when they received the message. CMS/PKCS7 might do what I'm needing IF:

  • The sending client includes the revocation response in the message
  • The signing PKI infrastructure is correct and not flawed
  • The validator will see the SMIME signature, validate it, and also validate the signature as well.

Given the inconsistent support for SMIME (e.g. gmail and all things Google) is there any software or technology that would validate in the way that solves my needs?

Is what I'm looking for viable, or am I using the wrong technology for the wrong purpose?