IETF Logo Mail Archive

Re: mail signing history, was Call for Community Feedback: Retiring IETF FTP Service

ned+ietf@mauve.mrochek.com Thu, 19 November 2020 00:36 UTC

Return-Path: <ned+ietf@mauve.mrochek.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E72903A10D6 for <ietf@ietfa.amsl.com>; Wed, 18 Nov 2020 16:36:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bDEhIzowlfhj for <ietf@ietfa.amsl.com>; Wed, 18 Nov 2020 16:36:19 -0800 (PST)
Received: from mauve.mrochek.com (mauve.mrochek.com [98.153.82.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C5283A10A9 for <ietf@ietf.org>; Wed, 18 Nov 2020 16:36:15 -0800 (PST)
Received: from dkim-sign.mauve.mrochek.com by mauve.mrochek.com (PMDF V6.1-1 #35243) id <01RS5W631SMO00COTK@mauve.mrochek.com> for ietf@ietf.org; Wed, 18 Nov 2020 16:31:11 -0800 (PST)
MIME-version: 1.0
Content-transfer-encoding: 7bit
Content-type: TEXT/PLAIN; CHARSET="US-ASCII"; format="flowed"
Received: from mauve.mrochek.com by mauve.mrochek.com (PMDF V6.1-1 #35243) id <01RS4XGHZZF4005PTU@mauve.mrochek.com> (original mail from NED@mauve.mrochek.com) for ietf@ietf.org; Wed, 18 Nov 2020 16:31:08 -0800 (PST)
From: ned+ietf@mauve.mrochek.com
Cc: John Levine <johnl@taugh.com>, ietf@ietf.org
Message-id: <01RS5W61D98A005PTU@mauve.mrochek.com>
Date: Wed, 18 Nov 2020 16:21:59 -0800
Subject: Re: mail signing history, was Call for Community Feedback: Retiring IETF FTP Service
In-reply-to: "Your message dated Wed, 18 Nov 2020 16:09:52 -0800" <130c5f14-9121-bc45-3c95-66aae899f2f3@mtcc.com>
References: <20201118234941.90CA7278F58D@ary.qy> <130c5f14-9121-bc45-3c95-66aae899f2f3@mtcc.com>
To: Michael Thomas <mike@mtcc.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/sq4sMaki2xK-_n_6spdgpBUB7hc>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Nov 2020 00:36:28 -0000

> > Large webmail systems have always been pretty strict about what header
> > addresses you can use. I don't think it was ever easy for one Gmail
> > user to send mail pretending to be another.

> But it was turning on submission auth that makes a really good case that
> a person did in fact send that piece of email. I wonder if this has been
> used legally yet? Most likely the vast majority of the time it doesn't
> need to come down to that.

I can't speak to use in court, but this seems relevant:

  https://blog.erratasec.com/2016/10/yes-we-can-validate-wikileaks-emails.html#.WA4khPkrLAW

Also, credit where credit is due: Matthew Green is the primary impetus
behind the push to publish keys:

 https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/

				Ned

v2.23.0 | Report a Bug | By Email