Subject: RE: comments on draft-rosenberg-sipping-spam-00.txt

From: "Gordon Fecyk" <[email-masked]>
Date: Thu, 15 Jul 2004 08:06:57 -0500

> >    Thus, instead of creating DNS entries containing the IP 
> address of
> >    each legitimate relay for a domain, the provider can give each
> >    legitimate relay a certificate that allows them to authenticate
> >    themselves as coming from that domain.  Such a technique 
> would work
> >    even in the face of IP address spoofing, which the marid 
> techniques
> >    are susceptible to.

Once again, where is there a practical, or even possible, IP spoofing problem
where the source IP can be spoofed in a TCP (where you need to talk back to
the client machine) connection?

And asymmetric routing doesn't count, because the receiving end of the
asymmetric route isn't going to be in any domain's allowed hosts list (or
said host has worse security problems than being spoofed in a spam run).

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 15 Jul 2004 07:37:00 -0700

> 
>  no said that public-key based client authentication was not possible.
> 
>  it is a perfectly reasonable idea.
>  
>  they said that it has not established any significant track 
> record of use.
> 
>  blithely relying on a public key infrastructure ignores approximately
>  15 years of failure to get one deployed and used on any large scale.

Last time I looked VeriSign was making over a billion dollars in revenue,
a significant portion of which comes from operating a large scale PKI.

I suspect that the reason that people falsely believe that PKI does
not exist is that they have no clue what a PKI really looks like. They
are still waiting for something that looks like Loren Kohnfelders
masters thesis of 1979, a thesis that was questioning the practicality
of running anything that looked like todays DNS, a reasonable question
at the time.

What is needed need here not involve certificates at all (except to
the extent that you might need to create self signed certs to have
something plug compatible with existing protocols).

If all you need to do is to authenticate a public key to a DNS name
you might as well use the DNS as a key distribution infrastructure.

The point of an SSL Web site certificate is that if you want to
accept ecommerce payments you need to establish rather more than
mere ownership of a domain name.

		Phill