Subject: RE: [Asrg] You say tomato, I say authentication

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Mar 2003 07:12:55 -0800

For the purposes of fighting spam the following configuration would be
sufficient:

1) Alice's client generates self signed cert
2) Alice's client uses DNS srv to discover XKMS service for email zone
3) Alice's client registers certificate with XKMS service

4) Alice sends email to Bob

5) Bob's client looks up policy of Alice's DNS zone, it is always
authenticate
	using S/MIME, no root key specified, XKMS service specified.
6) Bob checks that message is signed correctly
7) Bob retrieves Alice's self signed cert via XKMS locate

Obviously you get additional value from a trusted third party, particularly
if you want to use the certs for more than spam control.

However it is a heck of a lot better than what we have now security wise for
email which is in almost all cases diddly squat.

		Phill

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, March 11, 2003 9:22 PM
> To: [email-masked]
> Subject: [Asrg] You say tomato, I say authentication
> 
> 
> IMHO, people on this list have different ideas of 
> authentication and where
> to apply it.  Therefore a lot of messages are speaking at 
> cross purpose.
> 
> What I want from authentication, S/MIME, is to know 100% that an email
> address is the real email address of the sender.  NOT the 
> identity of the
> sender.
> 
> 
> - I can then drop any message which is not authenticated (you 
> have the right
> to message anonymously, but I should have the right to 
> decline to listen to
> you)
> 
> - I will allow any message from my friends / business 
> partners' mail domains
> straight through, and get on with my life
> 
> - I might allow messages from authenticated strangers in 
> trusted domains, to
> see what you have to say, but if you abuse it, 
> then I can choose to filter them, or their entire domain.
> 
> 
> As I said in my previous posting "[Asrg] Proven solution for 
> authenticating
> messages" - you don't need authentication software at the 
> client end, move
> it up to the ISP gateway and reduce the complexity of the 
> problem.  (In New
> Zealand, we don't have 1000's of ISPs, probably not even 100s).
> 
> 
> 
> Regards, Mike Pearson
> 
> Personal: The views expressed are not necessarily those of my 
> employer.
> 
> ph  +64 (4) 495-6769   mobile +64 (21) 631-731
> fax +64 (4) 495-6669 
> mailto:[email-masked] 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Justin B. Newman" <[email-masked]>
Date: Wed, 12 Mar 2003 09:38:43 -0600

>7) Bob retrieves Alice's self signed cert via XKMS locate

Has anyone here suggesting the use of certificates in fighting spam 
done an S/MIME interoperability testing?

<rant>
I'm all for the use of PKI to solve the world's problems... but... 
the fact is that the current implementations of S/MIME in off the 
shelf email products is worse than any implementation I've ever seen.

I'd seriously recommend that folks interested in utilizing PKI first 
survey the industry's capability of providing a PKI-based solution 
that works.  How many websites do you hit with IE/Mozilla throwing up 
its hands about a bad certificate?  Is it the site's fault or the 
browser's?  Usually the site's.  That said, have you ever tested the 
cert chain following capabilities of the browsers?  Talk about a 
buggy area.

I won't even go into certificate revocation issues...

</rant>

-jbn
(Former/Recovering PKI Implementer)