oxalis icon indicating copy to clipboard operation
oxalis copied to clipboard

[AS2] S/MIME canonicalization of application/xml with <CR><LF>

Open descala opened this issue 7 years ago • 0 comments

As per RFC 3851 https://tools.ietf.org/html/rfc3851#section-3.1.1

entities of major type "text" MUST have both their line endings and character set canonicalized. The line ending MUST be the pair of characters <CR><LF>

if I use Oxalis to send a payload with only LF, the S/MIME digest is calculated without canonicalization. when I use OpenSSL to verify the signature it is always invalid, because OpenSSL canonicalizes before digesting.

when I use OpenSSL to calculate the AS2 MIC, it always differs for the same reason.

if I send a payload with CR LF "Windows style" it all works as expected, because the file is S/MIME-canonical beforehand.

is it a PEPPOL specific parametrization of AS2? is not application/xml considered of "major type text"?

descala avatar Nov 06 '18 17:11 descala