ietf-asrg
[Top] [All Lists]

Re: [Asrg] porkhash: flexible anti-impersonation mail signatures

2003-04-03 13:07:52
On Thu, 03 Apr 2003 11:51:25 -0800 
Justin Mason <jm(_at_)jmason(_dot_)org> wrote:
J C Lawrence said:

I tend to the line that an audit trail should be full verifiable by
all stages in the transport, as well as subsequent to receipt (ie
forensices).  Its not enough to do it once at inception, or once at
receipt.  Once such a truth is established (by the audit trail) it
should remain 'true" for reasonably large values.

I agree BTW.  A factor in this is that we cannot trust audit trail
entries which are *claimed* to be verified by entities outside our
control -- generally, anything beyond our MX.

Right, that's one of the things I thought about with my forward chained
sigs approach.  The Received: headers in themselves can be checked for
internal consistency: does each signature line up with the claimed
public key?  And the public keys can be verified against DNS without
doing a damn thing to the DNS protocol or definitions, and without
requiring an external third party signator or clearing house for those
keys (sorry RSA/Verisign/BaltimoreTech/etc), _snd_ without running afoul
of crypto laws in various countries (it can use small non-milspec keys
with fair safety).

The idea was to get an audit trail with the least possible change to
established systems or requirements of participating nodes.  I don't
know if its the minimal path, but its as small as I've found to make it.

For example it's commonplace in spam nowadays to receive a mail at
one's MX, which claims it had established an audit trail (Received
headers) from an originating host, to the relay which opened the SMTP
conn to our MX -- whereas in actual fact, all the Received headers
before that one are fakes, inserted by the spamware, intended to throw
spam-reporters off-track.

Yeah, I get a lot of these.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
claw(_at_)kanga(_dot_)nu               He lived as a devil, eh?           
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg



<Prev in Thread] Current Thread [Next in Thread>