Re: message-id formatting
Ansgar -59cobalt- Wiechers <[email protected]> Thu, 29 Mar 2007 19:28:14 +0200
| Newsgroups | gmane.comp.security.forensics |
|---|---|
| Message-ID | <[email protected]> |
On 2007-03-29 Simson Garfinkel wrote: > On Mar 27, 2007, at 12:01 PM, Ansgar -59cobalt- Wiechers wrote: >> On 2007-03-27 Simson Garfinkel wrote: >>> On Mar 19, 2007, at 1:52 PM, Ansgar -59cobalt- Wiechers wrote: >>>> On 2007-03-16 [email protected] wrote: >>>>> I am trying to find the format of mac.com message-ids. The >>>>> following are examples of message-id's received in emails from >>>>> mac.com. >>>>> >>>>> [email protected] >>>>> [email protected] >>>>> >>>>> Any ideas? >>>> >>>> I'm not sure if I understand your question correctly. Are you >>>> looking for a regular expression to match those message-IDs? >>>> >>>> [0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}@MAC\.COM >>> >>> No. He's looking for a meaning of what they mean. >> >> Well, they're message-IDs, they don't mean anything by themselves. >> They're just supposed to be unique identifiers for a given message >> (e-mail, in particular). > > Actually, message-id's frequently have internal meaning, depending on > where they are issued. Maybe, but in that case the OP should have specified the context. Also this interpretation doesn't explain why he said that he was trying to "find the format" of these message-IDs. > If Apple just wanted a random 128-bit number, they wouldn't put the > dashes in it. There is internal structure --- a 32-bit number, three > 16-bit numbers, and a 48-bit number. We just don't know what those > numbers mean. Another poster mentioned off-list that the left part might be a UUID, so Apple may just have used a default method to create unique identifiers. Regards Ansgar Wiechers -- "All vulnerabilities deserve a public fear period prior to patches becoming available." --Jason Coombs on Bugtraq