<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">On 22 Jan 2019, at 17:02, Jan Münnich wrote:</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">Apparently MailMate uses SHA1 for S/MIME signatures:<br>
Content-Type: multipart/signed; boundary="=_MailMate_9C9B7CEB-A063-4594-B53C-4CA40977FBE0_="; micalg=sha1;<br>
<br>
SHA1 is not considered as secure anymore (<a href="https://en.wikipedia.org/wiki/SHA-1" style="color:#777">https://en.wikipedia.org/wiki/SHA-1</a>). I also noticed that Gmail doesn't verify SHA1-signed messages anymore: 'The signature uses an unsupported algorithm. The digital signature is not valid.'</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">My memory might be failing me here, but if I remember correctly then I did look into this a long time ago. I'm not really specifying which hashing method to use in the code. This is left to the Apple framework and I <em>think</em> this uses whatever is stated by the certificate itself, but I'm not 100% sure I ever verified that. I did look into how I could get the hashing method of the certificate and this was (at the time) ridiculously complicated. The idea was that I would then put that in the Content-Type header, but when I checked Apple Mail it didn't do this. It had sha1 in the header like above for a certificate which stated sha256.</p>
<p dir="auto">I'll note to look into it again and see if the above is completely wrong :-)</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">I don't know if you use a macOS library for S/MIME?</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">I use the one provided by Apple. CMSEncode() is the main function and, if I remember correctly, it provides no way to control the hash function used.</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">A test from iOS Mail used SHA256:<br>
Content-Type: multipart/signed; boundary=Apple-Mail-2496A2C0-AD94-4608-8970-57B8A409367C; protocol="application/pkcs7-signature"; micalg=sha-256</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">Ok, that's good to know.</p>
<p dir="auto">-- <br>
Benny</p>
</div>
</div>
</body>
</html>