Re: a header authentication scheme

On Oct 20 2004, William Leibzon wrote:
> 
> I have commented on authentication of received headers before some time 
> ago on asrg and I think on ietf-smtp (??) or ietf-822, would have to 
> search archives to find those posts.

Thanks, I'll try to look them up. Do you know roughly when?

> 
> But basicly the only way to truly authenticate this data is to use 
> cryptography, anything else is herecy and easily defeated and forged.
> 

You've obviously thought about this, so it should be fairly easy to provide
a concrete example. This would be very valuable for the filtering group.
Can you explain a successful forgery attack on the problem I posted? 
To fix ideas, here is perhaps the simplest concrete problem:

A -> M3 -> B. Here A is a spammer which sends mail to B, by talking
directly to the SMTP server M3, whose domain name is
mail.bigbucks.com. B's email address is [email protected], and you can
assume that B reads mail directly from the mail spool.

Your task is to write down for me a simple RFC2822 email message which
contains a forged Processed: header as outlined in my proposal, and
which can be submitted by SMTP to M3, in such a way that when B
receives the mail, it is guaranteed that B thinks the Processed:
header was added by an internal filter on the machine M3.

You may assume that it is known to A that the filters on machine M3
are named SpamAssassin, Bogofilter and GreatGooglyMoogly, and you may
also assume that those filters are stupid enough to allow the message
through to B in this instance.

-- 
Laird Breyer.