Subject: RE: namedroppers, continued

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 2 Dec 2002 11:12:36 -0800

First off, the problem of SPAM is one of the perfect being the enemy of
the good. If we can cut the spam by 95% then that is a pretty useful
achievement.

So, no I don't think that the folk selling feather luggage, herbal
viagra, p0rn etc are likely to go to that length in great numbers,
unless that is the Internet as a whole adopts the same type of measure
following our lead.

However I have thought ahead to the issues of scale here, let us imagine
that a large number of groups use the same scheme, that email agents
that filter based on signatures are available and widely used.

First, consider the effect of a minor authentication requirement on
certificate issue, the ability to read email sent to the address
specified in the certificate. Using that technique we could eliminate
spams with bogus addresses which itself would be a major advance. The
amount of spam that comes through with a valid email address is
vanishingly small.

Second consider that if the whole internet follows our lead and starts
to use cryptography routinely there are a lot of additional steps that
then become possible that are not practical until most people have a
public key and there is a means of discovering that via a DNS linkage.

Third one of the things we could do in an extended enrollment process
would be to get participants to agree to the following set of terms:

	1) Thou shalt not SPAM.
	2) Thou shalt permit your messages to be posted in the archives.
	3) Thou shalt provide timely notice of any intellectual property
claims.
	4) Thou shalt not take the name of the chair in vain unless she
deserves it.
	5) etc.

Then we could sue the b*#*@#&ds if they spammed after that. People have
been looking for a test case for digital signatures for ages, so don't
worry about the cost.

A side benefit of this is that it would cause a lot of people to start
using secure email and thus start to create some critical mass for email
security.

What we need is for someone to take Majordomo or the like and merge in
some sort of filter to check S/MIME and PGP signatures. Then find a
group that wanted to serve as a guinea pig (S/MIME or PKIX perhaps?).

Alternatively we should perhaps form a group 'Deployment of secure
email' which could apply this rubric. 

		Phill

> -----Original Message-----
> From: Aaron Swartz [mailto:[email-masked]]
> Sent: Monday, December 02, 2002 1:43 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: namedroppers, continued
> 
> 
> Hallam-Baker, Phillip wrote:
> > The only way to resolve this issue properly would be to 
> require every
> > submission to an IETF mailing list to be cryptographically signed
> > [and] to require the subscribers to register their signing key
> 
> And how do we prevent spammers from registering their signing 
> key? Are 
> you suggesting that we change the IETF's open enrollment policy?
> 
> -- 
> Aaron Swartz [http://www.aaronsw.com]
>

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 06 Dec 2002 17:08:36 -0500

In message <[email-masked]>, Fred Bake
r writes:
>At 08:28 AM 12/2/2002 -0800, Hallam-Baker, Phillip wrote:
>>The only way to resolve this issue properly would be to require every
>>submission to an IETF mailing list to be cryptographically signed (PGP
>>or S/MIME), to require the subscribers to register their signing key and
>>to then filter the mail sent out on the list so that only signed mail
>>gets through.
>
>I would be in favor of that, personally, as long as we can ensure that the 
>appropriate signature facility (be it RSA, PGP, or whatever) is freely 
>available to all who need to use it. The issue here is not us corporate 
>types who have a business reason to buy the software, it is the students 
>who often lack the funds. The big issue would be the procedures for posting 
>one's key to the appropriate place - what is to stop a spammer from posting 
>a key and sending the spam anyway? I'm not proposing a mechanism, but 
>someone who is good at such things might well find it of value.
>
Well, it's also the availability of the right signature facility in the 
myriad email clients people use.
>
>I think it was Steve Bellovin that suggested a procedure for reducing the 
>utility of spoofing source addresses in emails; if not, it was me and I 
>happened to suggest something his favorite algorithm fit into, by having a 
>host in each mail domain (mailid.example.com) be able to assert that its 
>domain had or had not sent an email within a given recent  time period 
>whose MD5 hash, when divided by <vector of prime numbers> resulted in 
><vector of remainders>. I could write that up in an internet draft if folks 
>think it makes sense. That would be a more global procedure that didn't 
>require a PKI and only addressed spoofed addresses. 
>
Wasn't me...

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 6 Dec 2002 15:45:43 -0800

> myriad email clients people use.

I disagree here, I believe it is a case of supporting the 
overwhelming majority of the platforms with software that
is freely available and free.

I don't believe that we should consider support for Open
Genera to be a 'must support' issue. Years ago people used
to whinge when someone sent a MIME attachment of 10K or 
so because it took too long to download over a 300 baud 
modem.

I don't think it is a bad thing to consider that high 
bandwidth connectivity is still a constrained resource 
absent in many less developed parts of the world. However
the complaints about using MIME never come from those
quarters.

> I could write that up in an internet 
> draft if folks 

The problem is not the PKI, the problem is the directory.

Deployment of PKI is easy. It is the Directory baggage that
people foisted onto PKI that is the failure. X.500 has set
us back more than the NSA crypto export regulations ever did.
LDAP merely compounds the problem, building failure on top
of failure.

We need a DNS linked PKI, not a directory linked PKI.

We need a PKI that only cares about the addresses the
applications route on. The idea of using human names for
PKI is bogus.

The directory PKI model fails for the Internet for many
reasons. First taxonomic organization is a broken concept.
No real world information is stuctured in that fashion,
not even genealogies (cousins marry cousins). The reason
that so many enterprise directory projects are fiascos
is that they are trying to fit data into a representation 
that is simply inappropriate.

The other main reason that directories are a failure for 
Internet PKI is that they are exclusively an internal
data resource. VeriSign has an employee directory accessible
from the inside of the company. There is no way it is 
ever going to be accessible from the outside.

At the Internet level trust relationships are complex,
they are certainly not hierarchical. Trying to store that
data in a taxanomic sturcture then do path discovery is
nonsense on stilts.

Linking the PKI to the DNS completes the picture. I want
to send Fred Baker an email, well I had better know his 
email address first. My email client can follow an SRV 
record from cisco.com to find an XKMS service for cisco.com
where I can ask 'what key should I use to send an
encrypted S/MIME email to [email-masked]'.

Allowing organizations to find out that [email-masked] is still 
working for Cisco is actually a security improvement. It
means that Office Max can shut off his personal stationary
account ordering privs the minute he leaves Cisco.

Don't reject the leverage that public key provides just
because you don't like the package people tried to wrap
arround it. The protocol you describe requires state and
is simply not deployable for large systems like hotmail.

It would be nice if the IETF could get ahead of the curve
this time instead of being the brake. We still have members 
of the IESG speaking to security forums disputing the 
utility of network security measures such as firewalls
even after Steve became a security area director.

We need to shift towards a comprehensive multi-level
security approach which accepts that there are problems
that cannot be addressed by the end to end argument.

Real users are saying that SPAM is their number one 
internet related problem today. Classify it how you like
but deal with it with a security mentality. The spamers
are seriously degrading the utility of email. We need
a short term approach to mitigate the problem (filtering)
and long term approaches that have the potential to
put them out of business. Authenticating the good signal
is completely complimentary with rejecting the bad.

		Phill