Re: preventing header tag spoofing without crypto

Philip Miller wrote:
> [snip original message]
> Well, you could talk about timing attacks on the observed delay between 
> transmission and addition of the Received header, but that's unlikely 
> and very easy to defeat. I think this risk can be safely ignored, 
> although we may wish to record it somewhere.
> Compared to a cryptosystem, this is a major improvement.

I just went and looked at RFC 282{1,2} for the specification for how time is 
recorded in the Received header [1], and there is a slight issue with this, 
although I sincerely doubt it applies to any modern implementation. Namely, 
the time recorded can simply have hours and minutes, without seconds. This 
makes it at least somewhat more predictable to spammers.
The best solution I can come up with is strongly recommending that any 
system using our new header ensure that time stamps in Received headers 
added by that system always have seconds.
I'll also email the rfc822 group to ask if there are any known 
implementations that omit seconds.

Philip Miller

[1] http://asg.web.cmu.edu/rfc/rfc2822.html#sec-3.3
The relevant BNF line is:
time-of-day = hour ":" minute [ ":" second ]