Subject: Re: [Simple] Offline messaging

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 12 Jun 2002 22:57:46 -0400

Digging through old emails, noticed there was no reply to this....

Torrey Searle wrote:
> In the current messaging draft, it seems that Message Replay attack 
> prevention relies on the ability to determine that the message 
> originated from a offline messaging server, and that the message is an 
> offline message.  
> 
> Are their any plans on adding a way of marking a message as an offline 
> message?

How would you trust such a marking?

I think there is no real way to reliably differentiate an offline 
message from a replayed one. The best you can hope for is that the 
offiline messaging server actually sends a new message, signing it, with 
the original messages, headers, signatures, and all, as the payload. 
Thats certainly possible with MESSAGE.

Generally, I think that, when there is a message received which has an 
old date, the user needs to be prompted to determine what to do. It 
could in fact be a new message, but the sender has an unsynchronized 
clock which is off by a day or two. You see that frequently in email....

I believe the MESSAGE draft pretty much provides that guideline.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
simple mailing list
[email-masked]
http://mailman.dynamicsoft.com/mailman/listinfo/simple