Method and system for conveying alternate acceptable canonicalizations of a digitally signed piece of electronic mail

• US 20060101271A1
• Filed: 11/10/2004
• Published: 05/11/2006
• Est. Priority Date: 11/10/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Thomas, Michael
• Granted Patent: US 8,195,947 B2
• Time in Patent Office: Days
• US Class Current: 713/180
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Methods and systems for sending a digitally signed electronic mail (email) comprising a message are described. A first canonicalization of a first version of the message is generated. A second canonicalization of a second version of the message is also generated. A single digital signature that includes both the first and second canonicalizations is generated. The digital signature is then sent with the message.

Claims

1. A method for sending a digitally signed electronic mail (email) comprising a message, said method comprising:

transforming a first version of said message to generate a first transformed message;

transforming a second version of said message to generate a second transformed message;

generating a single digital signature using both said first and second transformed messages; and

transmitting said digital signature with said message.

2. The method of claim 1 further comprising generating an nth transformed message, wherein said digital signature uses said first through nth canonicalizations.

3. The method of claim 1 wherein said transforming of said first version comprises generating a first canonicalization comprising a first message digest using a first hash of said message;

and

wherein said transforming of said second version comprises a second canonicalization comprising a second message digest using a second hash of said message.

4. The method of claim 3 wherein said generating said digital signature comprises concatenating said first and second canonicalizations.

5. The method of claim 3 wherein said digital signature further comprises indications that identify hash methods used for said first hash and said second hash.

6. The method of claim 1 further comprising encrypting said digital signature.

7. A system for generating a digital signature for an electronic mail (email) comprising a message, said system comprising:

a hasher for generating a first message digest for a first version of said message and a second message digest for a second version of said message;

a canonicalization generator for generating a first canonicalization comprising said first message digest and a first indication of a hashing method employed by said hasher and a second canonicalization comprising said second message digest and a second indication of a hashing method employed by said hasher; and

a canonicalization combiner for combining said first and second canonicalizations into a single digital signature.

8. The system of claim 7 wherein said hasher generates an nth message digest for an nth version of said message;

said canonicalization generator generates an nth canonicalization comprising said nth message digest and an nth indication of a hashing method employed by said hasher; and

said canonicalization combiner combines said first through nth canonicalizations into said single digital signature.

9. The system of claim 7 further comprising an encryptor for encrypting said digital signature.

10. A system for sending a piece of email comprising a message, said system comprising:

means for generating a first canonicalization of a first version of said message;

means for generating a second canonicalization of a second version of said message;

means for generating a single signature comprising both said first and second canonicalizations; and

means for transmitting said digital signature with said message.

11. The system of claim 10 further comprising means for generating an nth canonicalization of an nth version of said message and wherein said single signature comprises said first through nth canonicalizations.

12. The system of claim 10 further comprising means for encrypting said signature.

13. The system of claim 10 further comprising means for encrypting said canonicalizations.

14. A computer-readable medium having stored thereon computer-implementable instructions which when executed on a computer processor cause said processor to perform a method of sending an email comprising a message, said method comprising:

generating a first canonicalization of a first version of said message;

generating a second canonicalization of a second version of said message;

generating a single digital signature comprising said first and second canonicalizations; and

transmitting said digital signature with said message.

15. The computer-readable medium of claim 14 wherein said generating said first canonicalization is accomplished by performing a first hash function on said first version of said message, and said generating said second canonicalization is accomplished by performing a second hash function on said second version of said message.

16. The computer-readable medium of claim 14 wherein said method further comprises generating an nth canonicalization of an nth version of said contents and wherein said single digital signature comprises said first through and nth canonicalizations.

17. The computer-readable medium of claim 14 wherein said method further comprises encrypting said signature.

18. The computer-readable medium of claim 14 wherein said method further comprises encrypting said first through nth canonicalizations.

19. A computer readable medium having a digital signature stored therein for causing a functional change in the operation of a device, said digital signature comprising:

a first canonicalization for a first version of a message;

a second canonicalization for a second version of said message; and

an nth canonicalization for an nth version of said message, wherein each of said first, second and nth canonicalizations comprises a message digest generated by hashing said message and an indication of a hashing method used for said hashing.