Re: Devilish: Forget about DNS

Jeff_Silverman wrote:
> On Mon, 9 Feb 2004, Hadmut Danisch wrote:
> 
>>Present your proposal about how to use kerberos and let's discuss it. 
> 
> I'm still cooking the proposal - your objections are helpful and I 
> appreciate them.
> 
> My thinking is that the when the sender wish to send a message to a 
> receive, he/she contacts a trusted third party in a secure way who issues 
> a ticket.  This ticket is unique, and it has the IP address or IP name of 
> the authentication server.  The sender then includes the ticket 
> with the message.  The receiver gets the message, extracts the ticket and 
> contacts the trusted third party in a secure way to verify that the ticket 
> is valid.  The trusted third party validates that the ticket is valid.  
> The receiver than decides on the basis of internal policy whether to 
> accept the mesesage or reject the message.
> 
> If the message is authentically from a spammer, then it can be rejected.
> If the trusted third party has a history of getting defrauded, it can be 
> rejected and the sender can be told it has to find a new, trust worthy 
> authentication agent.
> If the message has no ticket, then the receiver policy will dictate 
> whether to deliver the message or not.
> 
> 

This sounds a lot like a callback mechanism that is similar to C/R. One 
of my early proposals, CRI 
(http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt), uses 
ESMTP and email to pass back tokens to the sender's server in order to 
determine whether the message was actually sent.

Also, the following presentation is very informative on this topic (see 
the last page on message tracking):
http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"There is nothing new under the sun"
-------