Subject: [Asrg] Forged Paths...

From: Art Pollard <[email-masked]>
Date: Tue, 08 Jul 2003 19:14:49 -0600

One of the big issues when it comes to spam is tracing where the message 
has originated from.  Of course, this is complicated when people forge 
headers to try to obfuscate the origin of the e-mail.

What I propose is this:

During each jump on the path that the e-mail takes to arrive to the sender, 
each interim mail server digitally signs the path.

So, typically, the path goes like this:

<Server1>,<Server2>,<Server3>,etc.

What I propose is:

<Server1/Signature1>, <Server2/ Signature2>, <Server3 / Signature3>, etc.

The signature would use the servers public / private keys and would be 
computed over the paths up to that point.  Thus, if you were server 3, you 
would digitally sign the path for server1, Server2, Server3.

Then if someone wants (or more specifically their software), they could 
request the public keys of the servers along the transmission path and 
ensure that the mail message actually took the path that the Path: header 
claims it did.

Yes, I am aware that one RFC says that headers aren't supposed to get above 
900 bytes or so in length.  I think that this will need to change 
eventually anyway, we might as well start now.  In this way, we can ensure 
that each message has an originated server that may be tracked down.  (Or 
the message simply gets rejected.)

Of course, this may be easily extended by adding a <User> to the path so it 
may be tracked back to the originating server and user.

I doubt that this would break many mail servers and even if it does, given 
an adequate amount of advance notice, I doubt it would be a problem anyway.

-Art

-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 8 Jul 2003 23:58:21 -0400

At 7:14 PM -0600 7/8/03, Art Pollard wrote:
>One of the big issues when it comes to spam is tracing where the 
>message has originated from.  Of course, this is complicated when 
>people forge headers to try to obfuscate the origin of the e-mail.

While in theory this could be an issue, in practice it does not tend 
to be.  Most Received: forgeries are quite easy to detect if you 
probe the network to verify them.  In addition, we see far less of 
those than we see open-relay and open-proxy spam.  And in both those 
cases the path would presumably be signed just fine.  And even if the 
message comes in legitimately, the fact that it's signed by (for 
example) 163.net still doesn't tell me if it's spam or mail from one 
of their legit users.

-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 9 Jul 2003 11:23:22 -0400 (EDT)

> each interim mail server digitally signs the path.

Can I ask you to elaborate on how this is usefull? Presumably the spammer
doesn't sign the path, or at least his signature isn't usefull. If he
uses an open relay that does sign the path, I can trace back only
as far as the open relay, which I can already do using the connection
address. Is the idea that a receiving MTA might discriminate among
messages from an open relay, depending upon the sources of the message? 
That is, an MTA might accept messages from an open relay if the source
was signed by a legitimate mailer? Is that an important capability?

Daniel Feenberg

---

From: Barry Shein <[email-masked]>
Date: Wed, 9 Jul 2003 17:46:56 -0400

> headers to try to obfuscate the origin of the e-mail.

What's your motivation for tracing its source?

I can think of some, I'm not being testy, just wondering what prompted
your suggestion specifically.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*