pgp/mime vs in-line pgp

[Werner Koch]

On Tue, 13 Apr 2004 15:52:51 -0400 (EDT), Atom 'Smasher' said:

> it would be nice to sign/encrypt attachments all at once, but i can always
> sign/encrypt them individually, before attaching them.

An attacker can delete one of those attached and signed documents and
insert an old (previously catched) version of that document which
carries an old price tag for the now entirely changed specification
document in the other attachment ...  Oh yes, you can add another
attchment with checksums over all the attached documents.

Why on earth going into such troubles if a well working and good
protocol exists for nearly a decade: rfc-1847 (MOSS) on which S/MIME
as well as PGP/MIME are based upon.  BTW, the changes in rfc-3156
compared to rfc-2015 are minimal and actually a clarification of some
points in 2015.  Rfc-2015 is nearly 8 years old - that's the
Windows-95 area!  So please don't say, there was not enough time to
implement such a simple thing.


Shalom-Salam,

   Werner