Subject: Re: [Asrg] Re: RMX evaluation

From: "John Fenley" <[email-masked]>
Date: Fri, 09 May 2003 10:13:51 -0600

Here is the problem as I see it:

1.   Anybody can send forged mail.
2.   Recipients need a way of verifying identity.
3.   any method of identity verification requires at least 1 out of band 
transfer of information.
4.   Various methods proposed have tried to use existing systems to 
facilitate this transfer.
5.   Existing systems were not designed with authentication in mind.

The solution I see:
We should develop a standard way of facilitating any out of band transfer, 
with authentication in mind.

John Fenley

Here is something I just thought of. Sorry if anyone feels i'm treating this 
list like a think tank, cause that's kind of how I see it.
=========================================
InformationChallenge/AutoResponse:
Sender side method that allows authentication.

When A message is sent, a trigger indicating IC/AR compliance is sent as 
well. Possibly placed in the header.
When a message in IC/AR format is recieved, they are responded to 
automatically with information the recipient has chosen.

These IC/AR requests could be of the format:
Subject: IC/AR:(sender picks random #)

Then responded by:
Subject: IC/AR Reply:(same random number back)
==body==
PgP Signature: <xxxxxxxxx>
other Signature: <xxxxxxxxx>
Valid Ip addresses: <xxx.xxx.xxx.xxx>, <xxx.xxx.xxx.xxx>,
Some future info: <XX&XXX.AAZZXX>

I think this would allow some sender authentication for people who want it, 
without messing with existing systems.

It assumes 3 things:
1. if you can recieve mail to an address you have the right to make some 
decisions about it.
2. The chance of somebody spoofing both a from address and a random number 
you choose, to trick you into recieving false info, is small.
3. the bandwidth, and processing done would not place too much extra burden 
on either senders or recipients.
4. This would not interfere with anyone not using the system.
==========================================

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg