Subject: RE: authenticated email

From: "Haren Visavadia" <[email-masked]>
Date: Thu, 5 Jun 2003 18:13:33 +0100

> the CA guarantees that the identification information contained in the
certificate

Each CA has its own CPS. How do you the CA conduct its CPS accordingly?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 5 Jun 2003 21:09:40 +0200

I'm not sure that I understand what you are asking.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 5 Jun 2003 21:18:17 +0200

On donderdag, jun 5, 2003, at 19:13 Europe/Amsterdam, Haren Visavadia 

> Each CA has its own CPS. How do you the CA conduct its CPS accordingly?

Fortunately, as far as the spam issue is concerned, this question is 
moot: unlike a breach of confidentiality, a breach of spamfreeness is 
readily detectable. CAs that do a bad job here will be out of (this) 
business fast.

---

From: "Haren Visavadia" <[email-masked]>
Date: Fri, 6 Jun 2003 09:59:09 +0100

If SMTP server uses certification authentication to trace all messages
easily. And each mail adds the SMTP's server's public key and then is
signed by the SMTP on the message, so when you receive it you know if
the signature does not verify it has been tampered.

---

From: "Haren Visavadia" <[email-masked]>
Date: Fri, 6 Jun 2003 10:15:03 +0100

If message contains the public key of SMTP (which could be made-up), the
internet header and message is signed.

If public key stated does not encrypt the message digest. This would
mean it has been tampered/modified. 

If the public key stated is correct, when it verifies the message
digest. The message digest will include the message and the internet
headers. If this is successful, you certain trust the internet headers
which can used to trace.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 6 Jun 2003 12:05:39 +0200

Haren writes:

> If SMTP server uses certification authentication
> to trace all messages easily. And each mail adds
> the SMTP's server's public key and then is
> signed by the SMTP on the message, so when you
> receive it you know if the signature does not verify
> it has been tampered.

This is a truckload of additional overhead, though.  Not only that, but even
a slight modification of the signed text will invalidate all the signatures.
Then what?

---

From: "Haren Visavadia" <[email-masked]>
Date: Fri, 6 Jun 2003 11:33:33 +0100

>a slight modification of the signed text will invalidate all the

I would personally delete the e-mail, since it can not be verified.