Diff: rfc9219v2.txt - rfc9219.txt

	rfc9219v2.txt	rfc9219.txt

	skipping to change at line 98 ¶	skipping to change at line 98 ¶
	14 [RFC2119] [RFC8174] when, and only when, they appear in all	14 [RFC2119] [RFC8174] when, and only when, they appear in all
	capitals, as shown here.	capitals, as shown here.

	Type signatures, examples, and property descriptions in this document	Type signatures, examples, and property descriptions in this document
	follow the conventions established in Section 1.1 of [RFC8620]. Data	follow the conventions established in Section 1.1 of [RFC8620]. Data
	types defined in the core specification are also used in this	types defined in the core specification are also used in this
	document.	document.

	3. Addition to the Capabilities Object	3. Addition to the Capabilities Object


	The capabilities object is returned as part of the standard JMAP	The capabilities object is returned as part of the standard JMAP
	Session object; see Section 2 of [RFC8620]. Servers supporting	Session object; see Section 2 of [RFC8620]. Servers supporting this
	_this_ specification MUST add a property called	specification MUST add a property called
	"urn:ietf:params:jmap:smimeverify" to the capabilities object.	"urn:ietf:params:jmap:smimeverify" to the capabilities object.

	The value of this property is an empty object in both the JMAP	The value of this property is an empty object in both the JMAP
	Session _capabilities_ property and an account's	Session _capabilities_ property and an account's
	_accountCapabilities_ property.	_accountCapabilities_ property.

	4. Extension for S/MIME Signature Verification	4. Extension for S/MIME Signature Verification

	4.1. Extension to Email/get	4.1. Extension to Email/get


	skipping to change at line 139 ¶	skipping to change at line 139 ¶
	it MUST be interpreted by the server as a request to return the	it MUST be interpreted by the server as a request to return the
	"smimeErrors" response property.	"smimeErrors" response property.

	smimeVerifiedAt:	smimeVerifiedAt:
	If "smimeVerifiedAt" is included in the list of requested	If "smimeVerifiedAt" is included in the list of requested
	properties, it MUST be interpreted by the server as a request to	properties, it MUST be interpreted by the server as a request to
	return the "smimeVerifiedAt" response property.	return the "smimeVerifiedAt" response property.

	The "smimeStatus" response property is defined as follows:	The "smimeStatus" response property is defined as follows:


	smimeStatus:	smimeStatus:
	"String\|null" (server-set). null signifies that the message	"String\|null" (server-set). null signifies that the message
	doesn't contain any signature. Otherwise, this property contains	doesn't contain any signature. Otherwise, this property contains
	the S/MIME signature and certificate verification status	the S/MIME signature and certificate verification status
	calculated according to [RFC8551], [RFC8550], and [RFC5280].	calculated according to [RFC8551], [RFC8550], and [RFC5280].
	Possible string values of the property are listed below. Servers	Possible string values of the property are listed below. Servers
	MAY return other values not defined below, as defined in	MAY return other values not defined below, as defined in
	extensions to this document. Clients MUST treat unrecognized	extensions to this document. Clients MUST treat unrecognized
	values as "unknown" or "signed/failed". Note that the value of	values as "unknown" or "signed/failed". Note that the value of
	this property might change over time.	this property might change over time.


	unknown:	unknown:
	An S/MIME message, but it was neither signed nor encrypted. This	An S/MIME message, but it was neither signed nor encrypted.
	can also be returned for a multipart/signed message that contains	This can also be returned for a multipart/signed message that
	an unrecognized signing protocol (for example, OpenPGP).	contains an unrecognized signing protocol (for example,
		OpenPGP).


	signed:	signed:
	An S/MIME signed message, but the signature was not yet verified.	An S/MIME signed message, but the signature was not yet
	Some servers might not attempt to verify a signature until a	verified. Some servers might not attempt to verify a signature
	particular message is requested by the client. (This is a useful	until a particular message is requested by the client. (This
	optimization for a JMAP server to avoid doing work until exact	is a useful optimization for a JMAP server to avoid doing work
	information is needed. A JMAP client that only needs to display	until exact information is needed. A JMAP client that only
	an icon that signifies presence of an S/MIME signature can still	needs to display an icon that signifies presence of an S/MIME
	use this value.) JMAP servers compliant with this document SHOULD	signature can still use this value.) JMAP servers compliant
	attempt signature verification and return "signed/verified" or	with this document SHOULD attempt signature verification and
	"signed/failed" instead of this signature status.	return "signed/verified" or "signed/failed" instead of this
		signature status.


	signed/verified:	signed/verified:
	An S/MIME signed message, and the sender's signature was	An S/MIME signed message, and the sender's signature was
	successfully verified according to [RFC8551] and [RFC8550].	successfully verified according to [RFC8551] and [RFC8550].
	Additionally, the signer email address extracted from the S/MIME	Additionally, the signer email address extracted from the S/
	certificate matches the From header field value, and the signer	MIME certificate matches the From header field value, and the
	certificate SHOULD be checked for revocation.	signer certificate SHOULD be checked for revocation.


	signed/failed:	signed/failed:
	S/MIME signed message, but the signature failed to verify	S/MIME signed message, but the signature failed to verify
	according to [RFC8551] and [RFC8550]. This might be because of a	according to [RFC8551] and [RFC8550]. This might be because of
	policy-related decision (e.g., the message signer email address	a policy-related decision (e.g., the message signer email
	doesn't match the From header field value), the message was	address doesn't match the From header field value), the message
	modified, the signer's certificate has expired or was revoked,	was modified, the signer's certificate has expired or was
	etc.	revoked, etc.


	encrypted+signed/verified:	encrypted+signed/verified:
	This value is reserved for future use. It is typically handled in	This value is reserved for future use. It is typically handled
	the same way as "signed/verified".	in the same way as "signed/verified".


	encrypted+signed/failed:	encrypted+signed/failed:
	This value is reserved for future use. It is typically handled in	This value is reserved for future use. It is typically handled
	the same way as "signed/failed".	in the same way as "signed/failed".

	The "smimeStatusAtDelivery" response property has the same syntax as	The "smimeStatusAtDelivery" response property has the same syntax as
	"smimeStatus" but is calculated in relationship to the "receivedAt"	"smimeStatus" but is calculated in relationship to the "receivedAt"
	date/time. Unlike "smimeStatus", the "smimeStatusAtDelivery"	date/time. Unlike "smimeStatus", the "smimeStatusAtDelivery"
	response property value doesn't change unless trust anchors are	response property value doesn't change unless trust anchors are
	added. (For example, addition of a trust anchor can change the value	added. (For example, addition of a trust anchor can change the value
	of a message "smimeStatusAtDelivery" property from "signed/failed" to	of a message "smimeStatusAtDelivery" property from "signed/failed" to
	"signed/verified". Note that trust anchor removal doesn't affect	"signed/verified". Note that trust anchor removal doesn't affect
	this response property.) The "smimeStatusAtDelivery" response	this response property.) The "smimeStatusAtDelivery" response
	property value allows clients to compare the S/MIME signature	property value allows clients to compare the S/MIME signature

	skipping to change at line 209 ¶	skipping to change at line 211 ¶
	by "smimeStatus", for example, to help to answer questions like "was	by "smimeStatus", for example, to help to answer questions like "was
	the signature valid at the time of delivery?".	the signature valid at the time of delivery?".

	Note that the "smimeStatusAtDelivery" response property value doesn't	Note that the "smimeStatusAtDelivery" response property value doesn't
	have to be calculated at delivery time. A JMAP server can defer its	have to be calculated at delivery time. A JMAP server can defer its
	calculation until it is explicitly requested; however, once it is	calculation until it is explicitly requested; however, once it is
	calculated, its value is remembered for later use.	calculated, its value is remembered for later use.

	The "smimeErrors" response property is defined as follows:	The "smimeErrors" response property is defined as follows:


	smimeErrors:	smimeErrors:
	"String[]\|null" (server-set). null signifies that the message	"String[]\|null" (server-set). null signifies that the message
	doesn't contain any signature or that there were no errors when	doesn't contain any signature or that there were no errors when
	verifying the S/MIME signature. (That is, this property is non-	verifying the S/MIME signature. (That is, this property is non-
	null only when the corresponding "smimeStatus" response property	null only when the corresponding "smimeStatus" response property
	value is "signed/failed" or "encrypted+signed/failed". Note that	value is "signed/failed" or "encrypted+signed/failed". Note that
	future extensions to this document can specify other "smimeStatus"	future extensions to this document can specify other "smimeStatus"
	values that can be used with "smimeErrors".) Each string in the	values that can be used with "smimeErrors".) Each string in the
	array is a human-readable description (in the language specified	array is a human-readable description (in the language specified
	in the Content-Language header field, if any) of a problem with	in the Content-Language header field, if any) of a problem with
	the signature, the signing certificate, or the signing certificate	the signature, the signing certificate, or the signing certificate

	skipping to change at line 231 ¶	skipping to change at line 233 ¶
	affected by the language selection.) In one example, the signing	affected by the language selection.) In one example, the signing
	certificate might be expired and the message From email address	certificate might be expired and the message From email address
	might not correspond to any of the email addresses in the signing	might not correspond to any of the email addresses in the signing
	certificate. In another example, the certificate might be expired	certificate. In another example, the certificate might be expired
	and the JMAP server might be unable to retrieve a Certificate	and the JMAP server might be unable to retrieve a Certificate
	Revocation List (CRL) for the certificate. In both of these	Revocation List (CRL) for the certificate. In both of these
	cases, there would be 2 elements in the array.	cases, there would be 2 elements in the array.

	The "smimeVerifiedAt" response property is defined as follows:	The "smimeVerifiedAt" response property is defined as follows:


	smimeVerifiedAt:	smimeVerifiedAt:
	"UTCDate\|null" (server-set). null signifies that the message	"UTCDate\|null" (server-set). null signifies that the message
	doesn't contain any S/MIME signature or that there is a signature,	doesn't contain any S/MIME signature or that there is a signature,
	but there was no attempt to verify it. (Retrieval of the	but there was no attempt to verify it. (Retrieval of the
	"smimeStatus" value can be used to distinguish these 2 cases). In	"smimeStatus" value can be used to distinguish these 2 cases). In
	all other cases, it is set to the date and time of when the S/MIME	all other cases, it is set to the date and time of when the S/MIME
	signature was most recently verified. Note that a request to	signature was most recently verified. Note that a request to
	fetch "smimeStatus", "smimeStatusAtDelivery", and/or "smimeErrors"	fetch "smimeStatus", "smimeStatusAtDelivery", and/or "smimeErrors"
	would force this response property to be set to a non-null value	would force this response property to be set to a non-null value
	if an S/MIME signature exists.	if an S/MIME signature exists.


End of changes. 10 change blocks.
	39 lines changed or deleted	41 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/