Re: message-id formatting

Simson Garfinkel <[email protected]> Thu, 29 Mar 2007 09:01:28 -0700
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
Hi, Ansgar.

Actually, message-id's frequently have internal meaning, depending on  
where they are issued. If Apple just wanted a random 128-bit number,  
they wouldn't put the dashes in it. There is internal structure --- a  
32-bit number, three 16-bit numbers, and a 48-bit number. We just  
don't know what those numbers mean.

On Mar 27, 2007, at 12:01 PM, Ansgar -59cobalt- Wiechers wrote:

> On 2007-03-27 Simson Garfinkel wrote:
>> On Mar 19, 2007, at 1:52 PM, Ansgar -59cobalt- Wiechers wrote:
>>> On 2007-03-16 [email protected] wrote:
>>>> I am trying to find the format of mac.com message-ids. The  
>>>> following
>>>> are examples of message-id's received in emails from mac.com.
>>>>
>>>> [email protected]
>>>> [email protected]
>>>>
>>>> Any ideas?
>>>
>>> I'm not sure if I understand your question correctly. Are you  
>>> looking
>>> for a regular expression to match those message-IDs?
>>>
>>>   [0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}@MAC\.COM
>>
>> No. He's looking for a meaning of what they mean.
>
> Well, they're message-IDs, they don't mean anything by themselves.
> They're just supposed to be unique identifiers for a given message
> (e-mail, in particular).
>
> Regards
> Ansgar Wiechers
> -- 
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>
smime.p7s (application/pkcs7-signature, 2.4 KB) - not displayed