Subject: RE: The utilitiy of IP is at stake here

From: "J. Noel Chiappa" <[email-masked]>
Date: Mon, 2 Jun 2003 18:28:02 -0400

> From: "Tony Hain" <[email-masked]>

    > 'anti-spam' is the wrong focus. Spam is a social problem, not an
    > engineering one.

Sorry, I don't agree with this logic: if it's valid, then why try to design
better locks, since theft is a social problem?

	Noel

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 2 Jun 2003 16:40:23 -0700

J. Noel Chiappa wrote:
> Sorry, I don't agree with this logic: if it's valid, then why 
> try to design better locks, since theft is a social problem?

You actually make my point since locks don't prevent theft, they simply
slow the perpetrator and provide an indication to everyone that there is
an attempt to keep things behind the lock private.  The point is the
IETF can't solve a social issue, but can provide a technology that may
deter some, though primarily allows the social management infrastructure
to take action. 

The IETF can build a technology (for the sake of discussion
'authenticated email'), that in turn can be a building block in the
social management attempt to control spam. By itself it will not prevent
receiving unwanted mail. Using it rather than the solicitation,
merchandizing, & titillation protocol is an indication that the mailbox
owner has an expectation of exercising controls. If we required the new
messaging system to accurately include the time at every hop (something
as simple as make NTP part of the implementation set), the basis for
legal records can be established. Couple the basic authenticated,
time-stamped message with existing or enhanced spam reporting
mechanisms, and the foundation for actionable social recourse is taking
shape. 

Are there other reasons for having authenticated, time-stamped email? I
am sure there are many, but the first I would like to see is the end to
the designation that a fax is acceptable legal evidence, while email is
not. Will an 'anti-spam' focused IETF wg provide that? Maybe by
accident, but not likely. Will an 'authenticated email' wg produce an
end to spam? Not initially, but like the lock, the result is a
technology that enables the social management sphere to accomplish the
greater goal.

Tony

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 02 Jun 2003 19:40:53 -0500

on 6/2/2003 5:28 PM J. Noel Chiappa wrote:
> Sorry, I don't agree with this logic: if it's valid, then why try to
> design better locks, since theft is a social problem?

All human action (and crime especially) is a result of opportunity and
desire. Locks and other defenses are designed to impede opportunity, while
the law is supposed to restrain desire.

Most of us have the equivalent of locks already, either in the form of
blacklists, filters, whatever. Coming up with more of these is fine, but
those will only address the question of utility within certain scopes. By
the same measure, a lock on a barn door in an Iowa cornfield has different
utility than a lock on the door of a Porsche in a crowded ghetto (on the
Internet, of course, everybody is your roommate). Nobody makes a lock that
is deployable everywhere, and which cannot be easily circumvented by a
willing expert. There's no reason to believe that any particular anti-spam
"solution" is going to work any better.

Security cameras are another form of deterrant, and which work towards
reducing both the opportunity and the desire. Think of an authenticated
mail system as being analogous to security cameras. You will still want to
have the locks that are appropriate for your needs, but making the
presence of security cameras known is going to keep some people from
succumbing to the desire, while having the criminals on tape will prove
useful when they decide they want to get past the locks.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 3 Jun 2003 06:44:12 +0200

Tony writes:

> Are there other reasons for having authenticated,
> time-stamped email? I am sure there are many, but
> the first I would like to see is the end to the
> designation that a fax is acceptable legal evidence,
> while email is not.

Assuming this statement is true (and it seems to be), what is the key
difference between fax and e-mail that makes fax so much more cogent in
court?  Or is it purely an arbitrary decision?

I've always wondered why signatures of ink on paper are binding, whereas
digital signatures are not, even though digital signatures are literally
billions or trillions of times more difficult to forge.

E-mail can be easily forged, but then again, so can a fax.  So what's so
special about fax?

---

From: Michael Thomas <[email-masked]>
Date: Tue, 3 Jun 2003 09:20:24 -0700 (PDT)

> technology that enables the social management sphere to accomplish the

I, like you, suspect that authenticated email may
be helpful in the spam wars, but this must not be
viewed in isolation. "Authentication" begs the
question of identity, trust in assertion,
ownership of identity, and the motivation and
foibles of third parties who would likely be
needed to scale this to anything that would be
useful.

In particular, the latter is almost without
exception a "be careful for what you wish for"
situation. Centralization of power for naming and
thus participation would be a very convenient tool
to exclude undesirables. Today that's spammers,
but where are the checks and balances? What
prevents less worthy causes? How do you prevent an
unreasonable accrual of power made real by virtue
of being the path of least resistance for the
great unwashed masses?

Unless these issues -- and many more -- can be
finessed, the cure might be worse than the
disease.

	 Mike

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 03 Jun 2003 23:13:24 +0200

> finessed, the cure might be worse than the

I thought I'd try this....

is there any particular disadvantage or centralization of power implied in 
me signing this message with my PGP key?

If not, is there any particular reason that I shouldn't do this all the 
time?

It's not a solution, but is there a downside?

                  Harald Alvestrand, wondering.....

---

From: Scott Francis <[email-masked]>
Date: Tue, 3 Jun 2003 15:25:49 -0700

On Tue, Jun 03, 2003 at 11:13:24PM +0200, [email-masked] said:
[snip]
> me signing this message with my PGP key?

not unless you consider the network of keyservers unduly centralized ...

> If not, is there any particular reason that I shouldn't do this all the 

A small number of mail client/PGP combinations may not interoperate correctly
with your particular mail client/PGP combination. However, that's certainly
no different (and considerably less widespread) than Outlook or other clients
sending all mail as HTML, which interoperates poorly with text-only clients.

(dead horse there, I know)

> It's not a solution, but is there a downside?

None that I have seen yet (except I'm realizing that either my passphrase is
too long, or the time period for which mutt caches it is too short). I'm sure
others will have different opinions though. Also, the debate between PGP/MIME
and the older plaintext signatures is a well-worn one.

-- 
Scott Francis || darkuncle (at) darkuncle (dot) net
      illum oportet crescere me autem minui

---

From: Michael Thomas <[email-masked]>
Date: Tue, 3 Jun 2003 16:02:52 -0700 (PDT)

> It's not a solution, but is there a downside?

It depends on what you mean by signing. Signing a
message in and of itself ought not hurt anything
modulo software bugs, etc. But the real question
is what does the receiving program (MTA, MUA) do
with that signature? At the very least it could
verify the signature, but then what? If it doesn't
verify do you drop it? (transitive trust comes
into play, but most likely). Does it do anything
beyond that?

Let me ask something in return: do you think that
just the act of signing mail -- with no trust
roots implied -- could help? My sense is that it
might in a sow-the-seeds kind of way for some
later goodness (it's as you say not a solution).
I too would be happy to hear downsides.

      Mike

---

From: Franck Martin <[email-masked]>
Date: 04 Jun 2003 12:19:41 +1200

I have tried both s/mime and pgp, well in fact still trying to use pgp.

The main problem is an implementation problem, where a bad and popular
version of Outlook was crashing when trying to verify the signature.

Now it all comes down to a global PKI, be it SSL/TLS or PGP. PGP has got
it running at an individual user level with the www.keyservers.net but
for TLS NO CA will deliver a certificate that can sign other
certificates (corporate e-mail certificates). I think there are some
attempt to do that...

If you look back on this list you will see a thread called GLOBAL PKI
where there was a lot of discussion at the time...

For spamming having signed e-mail is good as you can trace back
(traceability). But are you responsible when a virus on your computer
sends signed e-mail with a virus attachment.

At a SPAM meeting before INET2002 a company talked about certifying
advert....

Well all the options are open, but going to have a mainstream digital
signature is the goal...

Cheers
Franck

-- 

Franck Martin <[email-masked]>

SOPAC

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 3 Jun 2003 17:54:09 -0700

Anthony Atkielski wrote:
> ... 
> I've always wondered why signatures of ink on paper are 
> binding, whereas digital signatures are not, even though 
> digital signatures are literally billions or trillions of 
> times more difficult to forge.
> 
> E-mail can be easily forged, but then again, so can a fax.  
> So what's so special about fax?

I really don't know, maybe one of the armature lawyers will enlighten
us. My perception is that it is derived from the physical paper
evidence, and that forging email is so simple for Joe-sixpack that
everyone knows not to trust it. 

Tony

---

From: Jari Arkko <[email-masked]>
Date: Wed, 04 Jun 2003 09:02:57 +0300

> I too would be happy to hear downsides.

Without trust roots, webs of trust, or additional
mailing list daemon features, signed e-mail doesn't
really add anything, at least not now.

Signed e-mail could help ensure that e-mail
sent to a list comes from the same person
as the one who subscribed to the list. But then
again, the same feature could be implemented
much simpler by some header which must stay
constant from the same person and is stripped
off by the list daemon when forwarding the mail
to the subscribers.

More seriously, ensuring the sender's address
is right is useless IMHO unless there's a policy
for letting people to sign-up to a list. Spammers
could get a new address and generate a key pair,
sign up using them, send spam, and repeat with
another address and key.

So, its the same old question once again: how
do we all enroll ourselves to the same trusted
root or web of trust? Should the next PGP key
signing party be held in the plenary, for everyone?
Or maybe Harald stands in the IETF reception desk
to look at people's passports and certifies keys?
Hmm... maybe we could make PGP key mandatory in
registration, and have the secretariat form a web
of trust. At least we could trace every key to
a credit card number... sounds pretty good but
this wouldn't deal with the folks who don't come
to the meetings. Maybe we could turn on mandatory
PGP signing for all list e-mail for a year, and
at the end of the year make a web of trust for the
folks who sent e-mail that year. That wouldn't
be perfect, but it would sure reduce the size of
queue in front of Harald for the passport check ;-)

--Jari

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 04 Jun 2003 10:43:25 +0200

> I too would be happy to hear downsides.

well... if signing my email would help get rid of the nonconformant mailers 
on the path that do perverse stuff that breaks signatures, that certainly 
would be a benefit to the world.... verifying my own signature failed....

and here's why:

Original:

--==========1875089384==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Copy:

--==========1875089384==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

The difference matters not at all to anything but a signature verifier..... 
sigh.

                   Harald

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 13:02:11 +0200

Harald Tveit Alvestrand wrote:
> is there any particular disadvantage or centralization of power 
> implied in me signing this message with my PGP key?

Is there an IETF PGP keyserver somewhere?

Did you store the key securely on the keyserver?

Which keyserver?  Which port?  The particular network I connect to is
blocking most ports, so I can't retrieve your public key.

On another hand, the same particular network recommends that its users
use a particular MUA, which has built-in certs of certain CAs, which
allows readers of this email to trust I am who I claim to be, "legally"
(as if I showed an ID).

> If not, is there any particular reason that I shouldn't do this all 
> the time?

Will the government of the country you live in allow you to store
your public key on a public PGP keyserver?  (a particular government was
_not_ allowing it as of 1997, and if things have changed since then I'm
happy, but the "try and find out" way is high risk for me.)

Alex
GBU

---

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 4 Jun 2003 07:20:04 -0400

> off by the list daemon when forwarding the mail

Signed e-mail is useful for assuring that e-mail message sent at one
point in time is the same as an e-mail message sent earlier.  (Not
necessarily just for list mail, but also for person-to-person mail.)

> root or web of trust? 

For the specialized case of preventing SPAM, it's not necessarily
necessary to do the full authenticated e-mail where we know the
identity/passport number/Al Quaeda cell designation of the sender.
(Such things are of interest to John Ashcroft and others of that ilk
pushing "Total Information Awareness", but it's not really needed if
the only requirement is to stop SPAM.)

So imagine a system where if you want to send private e-mail to
someone, your public key figureprint must either be on a list of
acceptable senders, or you must submit some kind of mathematical
evidence that you have spent 5-10 minutes of CPU time crunching on
some particular problem.  After you do this, you get added to that
person's "good guys list", unless it turns out that you have sent spam
or something else annoying/abusive, at which point the user can remove
you from the trusted list, and the next time you want to send e-mail
to this person, you have to crunch for another 5-10 minutes of CPU
time.

Yeah, some special provision would be needed for CPU-limited PDA's,
but most PDA's that I've seen don't attempt to talk to the network
directly; they generally go through some kind of mutually trusted
gateway box that could do the CPU crunching for them.  (Or you could
argue that since that initial contact simply won't be supported from
by CPU-limited PDA's if they don't have a mutually trusted third party
that can "pay" the hashcash for them.)

The point of this message is not to argue that this is the Right Way
to do things, but to point out that you don't necessarily have to
solve the authenticated e-mail problem ("I invoke PKI; your project is
doomed to long, slow, painful, lingering death") in order to solve the
SPAM problem.

						- Ted

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 04 Jun 2003 13:25:26 +0200

> Is there an IETF PGP keyserver somewhere?

nope. we have had a lot of PGP key signing parties at IETFs, but nothing 
"official". I generally use wwwkeys.eu.pgp.net when I look for keys, but 
there's nothing very magical about that.

> Did you store the key securely on the keyserver?

Why should I? It's signed, so it's either there or not there - you can't 
fake it, just remove it. (And sometimes I wish the keyservers WOULD drop 
some keys - there's an old key of mine out there that I don't use any 
more....)

> blocking most ports, so I can't retrieve your public key.

It's attached below, too. Anything to increase the Kbytes-posting-stats :)

> happy, but the "try and find out" way is high risk for me.)

The Norwegian government does not care, so that's not a downside for me - 
but of course, your mileage may vary.

             Harald

---

From: Jari Arkko <[email-masked]>
Date: Wed, 04 Jun 2003 14:55:29 +0300

...
...
> some particular problem. 

Agreed. CPU time falls under the same class of schemes as the
address validity test that we already have for list e-mail; the
spammer has to invest more time and money, and have a bigger
risk of capture, the more we demand from unknown senders.

On list enrollment, you could even demand that the same address
be valid for some time, such as a day, through a delayed validation
scheme. Hit and run spammers might not be able to use the same
mail address for a very long time. Could we use the same for
person-to-person e-mail? If I read the spam a day after it has
been sent, will the spammer's mail agent still be there for
an automatic ack that the address is valid?

In general, I'm very much in favor of these types of mechanisms
as opposed to a knee jerk "lets authenticate everyone and see
if it helps" approaches ;-)

(This doesn't mean that such mechanisms are ready to be deployed
and problem free in all cases.)

> gateway box that could do the CPU crunching for them. 

And speaking of problems, I do think the imparity between different
devices is a real issue for the CPU time method. *Your* PDA may not
talk to the network directly, but *my* phone runs IMAP, SMTP, SSH,
SSL, HTTP, and streaming video from the net in addition to the usual
office applications such as Doom and C64 emulator ;-) Given this,
some people might argue that my phone can then afford the CPU
crunching as well. Perhaps, but the problem is that while the
capacity in the low-end increases, the same happens for the high-end
as well. I'd claim that the relative speed difference stays
constant over time.

I don't have a good suggestion on how to resolve this, however.
Perhaps the lowest common denominator is still a big enough
deterrent? Note that help from a network entity is not likely
solve this problem. Think about it: the average users are
not going to install their own network helpers. They are going
to rely ISPs' servers. So, we'd see SMTP servers that do the
number crunching on behalf of the ISP's customers. Enter a
spammer who claims to have a small device...

--Jari

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 14:16:50 +0200

Harald Tveit Alvestrand wrote:
> nope. we have had a lot of PGP key signing parties at IETFs, but 
> nothing "official".

I see, I might want to attend.

 From what I've read, keys (or fingerprints?) were read aloud.

> I generally use wwwkeys.eu.pgp.net when I look for keys, but there's 
> nothing very magical about that.

I see.  So your trust basically relies on the integrity of that
particular server.

> Why should I? It's signed, so it's either there or not there - you 
> can't fake it, just remove it.

Can't I just create a public key with the Harald's name and email
address and then post to this list claiming I'm Harald?

> (And sometimes I wish the keyservers WOULD drop some keys - there's 
> an old key of mine out there that I don't use any more....)

Sure, they should.

>> Which keyserver?  Which port?  The particular network I connect to 
>> is blocking most ports, so I can't retrieve your public key.
> 
> 
> It's attached below, too. Anything to increase the 
> Kbytes-posting-stats :

Thank you, I imported it, but the signature of previous messages didn't
verify, sorry.

Alex
GBU

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 04 Jun 2003 14:34:33 +0200

> I see.  So your trust basically relies on the integrity of that

not at all. Trust depends on the signatures of the key; I only use the 
keyserver to look for keys I don't have on hand.

> address and then post to this list claiming I'm Harald?

yes, you can. And after all, your real name might be Harald, so I shouldn't 
have a way to stop you from doing that.
However, those who care about whether it's me or you posting will look at 
who signed it - that's why my key block is so huge; it's got all these 
signatures dangling from it....

> Thank you, I imported it, but the signature of previous messages didn't
I know - signing messages that will be damaged in transit is a VERY hard 
problem....

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 14:57:21 +0200

Harald Tveit Alvestrand wrote:
> However, those who care about whether it's me or you posting will 
> look at who signed it - that's why my key block is so huge; it's got
>  all these signatures dangling from it....

So the level of trust depends on the number of signatures?

Can I also ask other lots of people to sign the key I create and then
pretend I'm Harald?

Otherwise, if certain of people who signed your key are "special", or
are highly trusted, can I ask who are those people?

>> Thank you, I imported it, but the signature of previous messages 
>> didn't verify, sorry.
>> 
> I know - signing messages that will be damaged in transit is a VERY 
> hard problem....

Right :-)

Alex
GBU

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 04 Jun 2003 15:09:45 +0200

Alexandru,

I think me replying to your questions here is no substitute for reading a 
good introductory text on PGP....... all this is explained, sometimes in 
gruesome detail, in the

> are highly trusted, can I ask who are those people?

That's for me and you to decide.... I decide who I trust, you decide who 
you trust. In my current keyring, I trust only 12 people.....

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 15:18:52 +0200

Franck Martin wrote:
> it running at an individual user level with the www.keyservers.net

Which is not secure :-)

> but for TLS NO CA will deliver a certificate that can sign other 
> certificates

One particular CA that is built in some particular MUA's does.

> (corporate e-mail certificates).

Nothing stops somebody working for that corporation to become the CA of
that corporation.  Thus, all people working for that corporation can
rely on that CA to trust each other.  Might fit some needs.

...my current understanding is.

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 15:25:59 +0200

Jari Arkko wrote:
> So, its the same old question once again: how do we all enroll 
> ourselves to the same trusted root or web of trust? Should the next 
> PGP key signing party be held in the plenary, for everyone? Or maybe 
> Harald stands in the IETF reception desk to look at people's 
> passports and certifies keys? Hmm... maybe we could make PGP key 
> mandatory in registration, and have the secretariat form a web of 
> trust. At least we could trace every key to a credit card number... 
> sounds pretty good but this wouldn't deal with the folks who don't 
> come to the meetings. Maybe we could turn on mandatory PGP signing 
> for all list e-mail for a year, and at the end of the year make a web
>  of trust for the folks who sent e-mail that year. That wouldn't be 
> perfect, but it would sure reduce the size of queue in front of 
> Harald for the passport check ;-)

Or maybe an IETF CA?

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 15:37:36 +0200

Harald Tveit Alvestrand wrote:
> I think me replying to your questions here is no substitute for
> reading a good introductory text on PGP....... all this is explained,
> sometimes in gruesome detail, in the

I'm sorry, I didn't want to sound like making questions.

It is correct that I can find the right info on PGP on some introductory
texts.

Alex
GBU

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 4 Jun 2003 08:21:44 -0600 (MDT)

> allows readers of this email to trust I am who I claim to be, "legally"

"Legally"?--Talk about a disaster in the making, but one that spammers
might save us from by demonstrating it's foolishiness.  Where will
the secret key for signing mail be kept, but in something like an
"address book"?  Will "user friendly" operating systems require a
passphrased for each use of the secret key?--probably not.  Even if
they did, think of the trojan horses you could easly write if you went
over to the dark side.  You might look for the WIN32 "event" that
posts the secret key passphrase "dialog box" and then capture keystrokes.
Or you might mount a dictionary attack on the passphrase using a canned
list of 1000 words plus the user names found on the system.  Or you
might pop-up your own imitation of the passphrase dialog box.  ...
but let's save that fun game for some other time.

The talk (and new laws) about legally binding crypto signing is as
ridiculous as the talk about how "personal firewalls" make unsafe
systems safe.  In the real world, virus and worms turn off "Zone
Alarm" and other "personal firewalls" before they start doing their
real work.

Vernon Schryver    [email-masked]

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 04 Jun 2003 18:15:00 +0200

Excuses, I jumped too quickly into this discussion, and only then I read
the other posts on this thread, that already express what's important;

Vernon Schryver wrote:
>> "legally" (as if I showed an ID).
> 
> "Legally"?--Talk about a disaster in the making

I quoted "legally".

> [...] require a passphrased for each use of the secret key?--probably
>  not.[...] trojan horses [...] that posts the secret key passphrase 
> "dialog box" and then capture keystrokes.[...] dictionary attack on 
> the passphrase [...] pop-up [...]

That is a lot of ways to compromise it.

---

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 4 Jun 2003 13:39:26 -0400

> spammer who claims to have a small device...

The ISP will have its own constraints about CPU time available to it.
So the ISP will almost certainly want to charge for the service
calculating the hashcash; and since this would only be necessary when
first contacting someone initially, this should be acceptable to most
people.... unless you want to contact hundreds of thousands of people
for the first time from your PDA.  But I can't think of anyone besides
spammer who would want to do that, so that would seem to be an
acceptable outcome.

						- Ted

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 4 Jun 2003 12:55:51 -0500

Thus spake "Michael Thomas" <[email-masked]>
> It depends on what you mean by signing. Signing a message in and
> of itself ought not hurt anything modulo software bugs, etc. But the
> real question is what does the receiving program (MTA, MUA) do
> with that signature? At the very least it could verify the signature,
> but then what? If it doesn't verify do you drop it? (transitive trust
> comes into play, but most likely). Does it do anything beyond that?

Well, if you use a score-based anti-spam system, the lack of a signature
could "cost" a message a few points, but that's about it.

The root problem here is we're trying to define an authentication system
without also defining the authorization or accounting systems to use it.

> roots implied -- could help?

It does, at least until spammers start signing their email too.

Does my signature on this message make you trust it more than, say, the ten
ads you got this morning for Viagra?  Why or why not?

S

Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 4 Jun 2003 12:50:52 -0500

Thus spake "Harald Tveit Alvestrand" <[email-masked]>
> It's not a solution, but is there a downside?

Yes.  Automated responders, such as Majordomo, don't understand MIME at all,
and therefore all the nasty MIME markup confuses them.  The problem gets
even uglier when you send MIME to trouble ticket systems.

On top of this, you have a great divide between PGP and S/MIME, with many
clients supporting either one or the other.  For instance, my client sees
PGP-signed email as a blank message with the original body as a text
attachment -- PGP-only clients have similar problems with S/MIME.

If I didn't worry about such problems, I'd have my client automatically sign
all outgoing email.  Of course, I'm not sure whether I'd do it with PGP or
S/MIME...

S

---

From: Michael Thomas <[email-masked]>
Date: Wed, 4 Jun 2003 11:36:40 -0700 (PDT)

> could "cost" a message a few points, but that's  about it.

Or signed, uncost it.
 
 > without also defining the authorization or accounting systems to use it.

One could obviously start envisioning servers with
known spammer keys, etc. Some have mentioned
whitelists but blacklists seem also possible so
far as they'd go. This isn't actually much
different than current practices, afterall.

I'd love to have somebody refute my personal and
completely unobjective observation that most
spammers (like virii hackers) are not very smart.
It's quite obvious that djinning up new key pairs
would be pretty simple (if relatively CPU
intensive), but look at the lag time between where
the current crop of filters are and the spam
that's sophiciticated enough to get around it. My
filters seem to catch -- even now -- about 80% at
least, and I haven't even upgraded spamassasin to
the Baysian version. Could the interval between
prevalence of signatures and spammers getting wise
to both needing to sign and needing to djinn up
lots of keys buy enough time to keep one step
ahead? My feeling is that it might. And I'd think
there would be huge economic incentives to move to
the next step before or as that starts to happen.

 > ads you got this morning for Viagra?  Why or why not?

Well, that's the implicit question. If the vast
majority of mail were signed -- with or without
trust roots -- would we be better off than the
current state of affairs? That is, could something
that hasn't been invented or utilized today be
possible if mail were simply signed? There's an
obvious bootstrap problem with all of this, and if
there were some marginal value of to what an MTA
or MUA could do *without* any messy trust issues
mandatory, then maybe the network effect might
allow more and more sophisticated schemes to
emerge.

		Mike

---

From: Michael Thomas <[email-masked]>
Date: Wed, 4 Jun 2003 11:42:35 -0700 (PDT)

Uri Blumenthal writes:
 > It might be good - but I think it will be ineffective in
 > spam-war.

Well, "effective" is a relative term. I guess I
don't see this as having any ultimate solution;
it's an arms race. The question is whether doing
so would give enough marginal value in and of
itself (which might even be neutral value, but it
would be better if it were at least slightly
positive) to get us to the next step where we can
possibly apply third party vouching, authorization
etc to the mix.

Thus, my question -- and I think Harald's as well
-- is mostly a *tactical* one, not a technical
one. IMO, it's the tactics which will allow or
inhibit forward progress.

		Mike

---

From: Michael Thomas <[email-masked]>
Date: Wed, 4 Jun 2003 11:52:40 -0700 (PDT)

> even uglier when you send MIME to trouble ticket systems.

Note that the type of signature needed here is
more of a _transport_ signature, not necessarily a
body signature. Thus it need not a priori be MIME
encoded. 

	Mike, though I've never noticed Majordomo
	 barfing on MIME

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 4 Jun 2003 22:42:39 +0200

Alexandru writes:

> Can't I just create a public key with the Harald's
> name and email address and then post to this list
> claiming I'm Harald?

Sure, but that wouldn't do much good, because of the way PGP's key
infrastructure works.

See, with PGP, you NEVER trust a key just because it claims to belong to a
specific entity.  You trust a key ONLY when the entity to whom that key
belongs communicates the key to you directly and securely (as by handing you
a diskette in person).  Thereafter, you can use that key, which you can now
trust to be valid, as a source of validation for other keys, in that you can
choose to trust any other key that is signed by the one key that you already
trust (the degree to which you do this is up to you, and depends mainly on
how much you trust the owner of the first key as a reliable "introducer" of
other entities and their keys).

Thus, you'd never trust a key just because it was on a public server, but
you might trust it if it were signed by someone whose key you already trust,
and you might trust it if you received the key directly from its owner.

PGP's great advantage is that it does not impose any specific trust model,
nor does it require that everyone trust a single certification authority.
This is a huge benefit compared to many other public-key infrastructures.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 4 Jun 2003 22:46:51 +0200

> So the level of trust depends on the number of signatures?

No, it depends on who signed the key.  If you trust the people who signed
the key, then by extension, you can trust the key (because presumably
trustworthy individuals would not sign a key if they were not certain that
the key was truly what it claimed to be).

Similarly, you should never sign a key unless you've received it directly
from the owner.  Signing a key that you happened to find somewhere is very
bad practice, because signing a key implies that you are CERTAIN that the
key belongs to whomever it claims to belong to.

> Can I also ask other lots of people to sign the
> key I create and then pretend I'm Harald?

Sure, but trustworthy individuals aren't going to sign your key unless they
are certain that you really are who you claim to be.  Untrustworthy
individuals might sign your key in any case, but nobody is likely to trust
those individuals as "introducers" of your key.

> Otherwise, if certain of people who signed your
> key are "special", or are highly trusted, can I
> ask who are those people?

They are identified by their signatures.  Whether or not they are trusted is
up to you.

Ultimately, you have to start with a key that you receive directly at some
point.  This gives you a key that you can rely upon for signatures of other
keys.  The best policy is to reliably obtain the keys of several people whom
you'd trust as introducers for other keys, and then go from there.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 4 Jun 2003 23:08:07 +0200

Stephen writes:

> Does my signature on this message make you trust
> it more than, say, the ten ads you got this morning
> for Viagra?

Yes.

> Why or why not?

It proves who you are, which means that you expose yourself to a certain
extent in the event that you do anything inappropriate with your e-mail.
This implies that your intentions are honorable; and even if they are not,
the signature makes you easier to track down and take action against.  So it
makes one feel a bit warmer and fuzzier.

---

From: Franck Martin <[email-masked]>
Date: 05 Jun 2003 12:35:29 +1200

www.spamassassin.org is a cost based system which is quite useful but
has many false positives too....

The best system I have found is tmda.sourceforge.net which concept is
used on a couple of commercial individual systems...

The concept is quite simple... 

Someone unknown to me send me an e-mail. I do not receive this e-mail
yet but an automatic reply ask the person to perform a task to
authenticate itself... Like replying to a specific address after reading
the message (something like a simple Turing test to prove the person is
human). The e-mail of this person is then added to my whitelist, I
receive this person e-mail as well as all subsequent e-mails....

Any person that wants to talk to me will follow the procedure... any
spammer will not bother to follow the procedure because suddenly it
costs him time therefore money... Remember it is a Turing test so a
machine cannot pass it....

Now what digital signing should bring, the power to sue because of the
traceability.

Cheers

---

From: Einar Stefferud <[email-masked]>
Date: Thu, 5 Jun 2003 00:26:06 -0700

Wow!  What a mighty leap of faith!

Let me offer a different view...  

Stephen's CERT proves that the sender is a person who got a CERT from some CERT provider and has a contract with that provider, but has no contract with Anthony, 
so that when Steven does something bad to Anthony, like snd him some spam, and 
Anthony complains to the CERT provider, the CERT provider is going to say 
"You don't have any contract with us, so we do not owe you anything."

In fact, Anthony might not even be findable because of his holding a CERT, 
because he was able to obtain the CERT with false information.

So, I have to ask why you trust those CERTS.

I don't trust em just because they come with a contract that denies all kinds 
of liabilities in the reliance on or use of those CERTS.

The problem is that I do not trust the transitivity of trust as required by PKI.
This is because I have ever seen proof of trust transitivity.

Show me the proof of it and I will believe it, if your proof stands up!

Cheers...\Stef

At 23:08 +0200 6/4/03, Anthony Atkielski wrote:
>Content-Type: application/x-pkcs7-signature;
>	name="smime.p7s"
>Content-Disposition: attachment;
>	filename="smime.p7s"
>
>Attachment converted: Viking5:smime.p7s (????/----) (00097E08)

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 5 Jun 2003 09:58:33 +0200

Franck writes:

> Someone unknown to me send me an e-mail. I do not
> receive this e-mail yet but an automatic reply ask
> the person to perform a task to authenticate itself...
> Like replying to a specific address after reading
> the message (something like a simple Turing test to
> prove the person is human). The e-mail of this person
> is then added to my whitelist, I receive this person
> e-mail as well as all subsequent e-mails....

All well and good in principle, but many of your correspondents will be
confused by the automatic reply, and many also will not consider it
worthwhile to perform the authentication task just to join your whitelist.
So you will lose legitimate e-mail in this way, just as you would with
automated spam filter.

> Any person that wants to talk to me will follow
> the procedure ...

Any person who wants to talk to you badly enough will follow the procedure.
But other correspondents may find the task so time-consuming and troublesome
to carry out, and so will simply abandon their attempt to communicate
instead.  In some cases, these latter correspondents may have important
things to say.  So you risk the loss of important, legitimate e-mail.

> ... any spammer will not bother to follow the procedure
> because suddenly it costs him time therefore money ...

The problem is that it will cost ALL of your correspondents time and money.
Those who do not wish to spend extra time and money to talk to you will stop
communicating, even if they are not spammers.

Here again, the fundamental difficulty is that there is no way for a machine
to distinguish between spam and legitimate e-mail; any remedy applied to
spam will also reject legitimate e-mail, and any remedy that guarantees
passage of all legitimate e-mail will also allow spam to get through.  Only
individual human inspection of e-mail messages can separate spam and
legitimate e-mail with 100% accuracy.

> Now what digital signing should bring, the power
> to sue because of the traceability.

Not if the signing party is out of legal reach.  Once again, the problem is
a human problem, in that there is no fundamental, machine-readable
difference between a spammer's signature and a legitimate correspondent's
signature, so just putting signatures on e-mail will not allow spam to be
automatically excluded, and requiring signatures will reject legitimate
correspondents just as readily as it deters spammers.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 5 Jun 2003 10:09:03 +0200

> Wow!  What a mighty leap of faith!

That's why they call it trust.

> Stephen's CERT proves that the sender is a person
> who got a CERT from some CERT provider and has a
> contract with that provider, but has no contract
> with Anthony ...

No.  In cryptographic authentication, signing a message with a private key
proves only that the signing entity had access to the private key--nothing
more.  Everything else is human interpretation.

If the human side is handled correctly, crypto authentication can be very
useful and secure indeed.  But if you cannot trust the human management, the
high technical security of the authentication method itself is of little
use.

> ... so that when Steven does something bad to Anthony,
> like snd him some spam, and Anthony complains to the
> CERT provider, the CERT provider is going to say

The provider of the certificate is not a police organization, and there is
no reason why I would complain to them.  A certification authority does not
certify anything except the authenticity of a certificate, that is, the CA
guarantees that the identification information contained in the certificate
is true and correct.  CAs do not guarantee anything else, nor are they
responsible for the actions of the entities they certify.  As long as a
subscriber is not attempting to forge certificates or identities within
certificates, the CA is not involved.

Expecting the CA to act as a police organization is like complaining to the
Federal Reserve Board when you pay money to a tradesman and you have a
dispute with him.

> In fact, Anthony might not even be findable because
> of his holding a CERT, because he was able to obtain
> the CERT with false information.

It's up to the CA to verify entities sufficiently that falsification of
certificates is difficult.  The CA's business depends on the trustworthiness
of its verification.  However, if the identity does indeed check out, the CA
 has done its job and owes you nothing else.

> So, I have to ask why you trust those CERTS.

It depends on the CA.  Verisign seemed trustworthy until they handed a
brand-new Microsoft certificate to a complete stranger in an almost
unbelievably stupid breach of security, so I have my doubts about them now.
You have to trust a CA to a certain extent in order for it to be useful,
just as you have to trust a bank to a certain extent before you are willing
to put money on deposit with them.

> I don't trust em just because they come with a contract
> that denies all kinds of liabilities in the reliance
> on or use of those CERTS.

That's your decision, not mine.  Perhaps if the above explanation helps you
to understand the true purpose of certifying authorities, you'll adjust your
conclusions.

> The problem is that I do not trust the transitivity
> of trust as required by PKI.  This is because I have
> ever seen proof of trust transitivity.

There isn't any proof beyond the basic technical level of keys and
signatures.  The rest is a human issue.

> Show me the proof of it and I will believe it, if

Whether you believe it or not is irrelevant to me.  I'm just explaining how
it is done.

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 05 Jun 2003 12:51:59 +0200

--On tirsdag, juni 03, 2003 23:13:24 +0200 Harald Tveit Alvestrand 
<[email-masked]> wrote:

> is there any particular disadvantage or centralization of power implied
> in me signing this message with my PGP key?
>

well, it turns out that I have to answer this question with "yes".....

1) There is list software out there that munges headers on inner body 
parts, making the signature not verify. If people also discard "signature 
failed" messages, that means that some people will not hear what I say; for 
others, it will just irritate them and condition them to dismiss warnings 
about bad signatures - not a good idea in the long run.

2) There is MUA software out there that displays MIME security multiparts 
as an empty message with attachments. This means that some people will be 
irritated when I send messages in this signed format.

So there is still a downside to using signed mail. Not good.

[for those who advocate non-MIME signing schemes.... different topic.]

                  Harald

---

From: Uri Blumenthal <[email-masked]>
Date: Wed, 04 Jun 2003 14:28:04 -0400

>  > me signing this message with my PGP key?

IMHO none (except for the extra inocnvenience of periodically
typing in the [long!] passphrase and hitting an extra key).

>  > If not, is there any particular reason that I shouldn't do this all the 

See above. :-)

> into play, but most likely). Does it do anything

1. IMHO if the sig doesn't verify - you drop the e-mail
    (just like if IPsec packet comes with a corrupted MAC,
     you drop it).

2. Spammers might just generate one-day PGP key, self-sign it,
    upload to a server - and voila! - for this day they're free
    to send.

    So the trust will have to be established, only certain
    signatures be accepted, etc. This means - a closed list.
    I'd be OK with that, actually.

---

From: Dean Anderson <[email-masked]>
Date: Thu, 5 Jun 2003 11:21:18 -0400 (EDT)

This is also true of drivers licenses, or any other identification.

The trust is transitive only to the extent you trust the CERT provider,
and to the extent that the CERT holder hasn't had they private key
compromised.  If the Cert authority can't be trusted, or can be fooled,
then all bets are off. The identity requirements for one large, well
respected Cert provider, for company certs, is a copy of the articles of
incorporation. This, just like birth certificates, can be obtained by
anyone who wants to pay the $15 fee.

Then there is the issue of sloppyiness with the key, or virus infection,
or other ways the private key can be compromised.  If the private key is
compromised, anyone with the private key can sign mail with your Cert.
Partly this is a function of computer hygiene. Not everyone on the planet
will be able to maintain this. It is quite easy to steal a password on a
shared PC.  This isn't hypothetical.  I have a customer where the
employees don't each have a personal computer.  Yet they all send email
via a webmail interface.

This type of solution isn't going to work, either. It might work for some
small groups, but it won't work for everyone, everywhere.

		--Dean

On Thu, 5 Jun 2003, Einar Stefferud wrote:

> Stephen's CERT proves that the sender is a person who got a CERT from
> some CERT provider and has a contract with that provider, but has no
> contract with Anthony, so that when Steven does something bad to
> Anthony, like snd him some spam, and Anthony complains to the CERT
> provider, the CERT provider is going to say "You don't have any contract
> with us, so we do not owe you anything."
>

---

From: Einar Stefferud <[email-masked]>
Date: Thu, 5 Jun 2003 00:26:06 -0700

Cheers...\Stef