Subject: Re: [Asrg] RE:ASGR 8a Use of certificates

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 2 Apr 2003 15:37:13 -0800

Outlook and outlook express both support s/mime and have done for a very
long time

Notes also has smime support since release 5 and before that did PEM.

Webmail can be upgraded without much difficulty, the code already exists in
windows and open ssl.

There are a few infrastructure and plumbing bits missing, inparticular lets
get support for free self signed certs in the clients. Lets get some better
cert discovery infrastructure out there. Nothing impossible.

These are not the only options.

The key is to realize that a lot of the problems of PKI came from a broken
directory model that assumed we were going to transition to OSI and ignored
the DNS

 -----Original Message-----
From: 	Vernon Schryver
Sent:	Wed Apr 02 15:16:11 2003
To:	[email-masked]
Subject:	Re: [Asrg] RE:ASGR 8a Use of certificates

> From: "Tom Thomson" <[email-masked]>

> ...
> SMTP-AUTH is specifically desgigned for a closed trusted environment 
> (read the RFC - the words it uses are "within a trusted enclave") so 
> it's not at all surprising that it hasn't been deployed to solve a 
> problem in a wide-open uncontrolled environment. Do SUBMIT or 
> SMTP-TLS have relevance to our issue any more than SMTP-AUTH does?  I
> think not!

I think that caveat about SMTP-AUTH is merely a statement of the fact
that talk about authenticating strangers is nonsense.  Authentication
is only half of authentication and authorization.  Does it make sense
to trust everyone outside your trusted enclave?--of course not!  You
cannot know whether a stranger, whether authenticated or not, sending
you mail is also sending copies to 50,000,000 of your closest friends.
Authentication is meaningless outside "a trusted enclave."

> Although some MUAs have signature/checking capabilities, rather a lot 
> have no such capability.  Do any of the webmail systems have such 
> capability?  Even where an MUA has the capability, is it usable by 
> the average user?  Plainly and simply, the signature and checking 
> capabilities of current MUAs are not designed to address our issue.

I think that is wrong, because I think most people use Netscape, Outlook,
or Outlook express.  I know Netscape has long handled cert-signed mail,
because I've tried it.  I've not tried Outlook (Express), but I've the
impression they also can do it.

> Post Script:   I suspect vernon will be very unhappy if the group 
> ends up supporting approaches other than one particular one;  but 
> I'm not going to decry that particular one because it wasn't 
> invented here, and I just wish he would show other members of this 
> list that same courtesy. We are going to need to apply lots of 
> partial solutions and not reject anything that is useful just 
> because it will not solve more than 90% of the problem on day one.

Just for my own information, could you let me know which approach I
prefer?

I can't think of anything that might qualify as a solution to spam
except what I think is inevitable legislation that will tax or license
bulk mail.  That will not really solve the spam problem but only change
the spammers and limit the total spam in most mailboxes.  I do hope
that the DCC might help with spam after that legislation, but it does
not qualify as a solution now or then.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric D. Williams" <[email-masked]>
Date: Wed, 2 Apr 2003 19:33:40 -0500

> Authentication is meaningless outside "a trusted enclave."

I'm sorry, I do not agree.  Authentication is only one albeit an important 
concept within the context of security associations.  It does not require a 
trusted enclave to be relevant, in fact on abstraction authentication is 
required to establish access to the trusted enclave, e.g. logging into your LAN 
or logging onto a dial-up.  Now the point you make about it not being complete 
with out a complementary authorization element is absolutely true, but that 
does not invalidate all other uses of authentication (an X.509 cert is a prime 
example of this, as they can be issued with generalized uses based on it's CP) 
there are in fact other important aspects I am sure you are aware of such as 
the vetting processes associated with establishing a credential or credentials 
used to authenticate.  I don't think that requires a trusted enclave either, 
but in all circumstances there is a requirement for an association between the 
credential and that vetting process (however inconsequential that process may 
be).

8<...>8

> not qualify as a solution now or then.

I know you have got to be joking here, right?  I too sometimes believe that 
technical problems are not always solved by technology, and you may be right, 
but I think this particular one deserves more attention before I come to that 
conclusion.  IDK, but I think you do too, otherwise why would you be 
participating so vigorously?

-e

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 2 Apr 2003 17:12:05 -0800

Forgot to mention here that the point I was making here 
is for deployment of email encryption as an end in itself.

If spam helps bootstrap that, it is not a bad thing, but
the client email encryption problem needs solving.

		Phill

> From: Hallam-Baker, Phillip [mailto:[email-masked]]
> Sent: Wednesday, April 02, 2003 6:37 PM
> To: 'Vernon Schryver'; [email-masked]'

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 8 Apr 2003 13:30:25 -0700

> Versign demonstrated the low value of affordable authentication when
> it sold the identity "Microsoft Corporation" for about $350 to to an
> individual who fraudulently claimed to be a Microsoft employee.  

The mistake was discovered by VeriSign and the certificate revoked.
It has never been used. The procedures have since been changed.

> > Actually this is empirically not the case. There is no analogue 
> > of CALEA and the spam senders have the ability to hide behind
> > offshore machines. Junk fax senders typically do not have that
> > type of option on the telco network which is highly regulated.
> 
> Empirically that's not the case.  America Blastfax's Denver satellite
> could have been as anonymous and slippery as any spam amplifier.  ABF
> evidently rented local space to plaster the local calling area with
> junk faxes from their Texas offices.  They could have paid cash for
> the space and the phone lines and moved to new space and phone lines
> once a month or before things got hot.

You can make that argument but the facts you cite argue against it.

> As Phillip Hallam-Baker knows, I have never said "80% of spam comes
> from free email providers," because we both know that is not true.
> We both know that rate limiting by free providers is irrelevant.

Your web site states that blocking mail from those addresses cuts out 80%
of all spam. 

> If certs were required for mail, then free providers would issue certs
> along with usernames and passwords, and for the same price and with
> the same due diligence in checking that the applicant is not really
> Alan Ralsky that they now excerise.

You have the end-to-end principle on the brain here. No there is no
point in issuing client certs to such people. Authenticate the
hosting service, the fact of interest is that they implement velocity
limits.

		Phill