If you examine an S/MIME-signed file with
$ openssl cms -in file.sgn -noout -cmsout -print
you see that S/MIME capabilities are also included in the signature:
... object: S/MIME Capabilities (1.2.840.113522.214.171.124) value.set: SEQUENCE: 0:d=0 hl=2 l= 106 cons: SEQUENCE 2:d=1 hl=2 l= 11 cons: SEQUENCE 4:d=2 hl=2 l= 9 prim: OBJECT :aes-256-cbc 15:d=1 hl=2 l= 11 cons: SEQUENCE 17:d=2 hl=2 l= 9 prim: OBJECT :aes-192-cbc 28:d=1 hl=2 l= 11 cons: SEQUENCE 30:d=2 hl=2 l= 9 prim: OBJECT :aes-128-cbc 41:d=1 hl=2 l= 10 cons: SEQUENCE 43:d=2 hl=2 l= 8 prim: OBJECT :des-ede3-cbc ...
In rfc2633 section 2.5.2 it is stated that these capabilities are included to show
... what the client announcing the SMIMECapabilites can support. A client does not have to list every capability it supports, and probably should not list all its capabilities so that the
capabilities list doesn't get too long.
This may explain, why for example
sha1WithRSAEncryption is not in my list here. (Although it's quite important.)
But what use has this list then? Is it just there to have more attributes within a signature to design it in a more inimitably way?