RE: CAPTCHA over smtp (yet another spam solution to discuss)

Joachim Kupke wrote:

> Brian Candler wrote:
> 
> > > Repudiable signatures.  Another application of C/R email.
> > 
> > I'm not sure, but I think you mean "non-repudiable signatures".
> 
> No; "repudiable" is correct.  The verifier sends a challenge, and
> computing a valid reponse requires the private key.  But the prover
> can repudiate ever having "signed" (in the offline sense) because it
> is trivial to manufacture, given any response, a corresponding
> challenge.

I agree with Brian that there is probably some confusion here.  One of
the strengths of public key signatures such as GPG is that they are
non-repudiable.  Once you sign a message with GPG, you cannot later
deny it until such time that the cryptography is no longer secure.
You can revoke the certificate at any point in the future, for example
if your private key becomes compromised.  However, the revocation
timestamp is when it is received by the keyserver.  You cannot back
date it, as that would permit repudiation.

Perhaps you mean that the authentication for a message in a system like
IM2000 does not have to survive beyond the particular session?  That is
indeed true.  For the purposes of ordinary email, it is _not_ necessary
for signatures to be verifiable later.  If your MTA validates the
sender's identity assertion during the session, and you trust your MTA,
that is good enough.

These kind of signatures are sometimes called ephemeral, like session
keys in SSL.  If I sign a message to you with an ephemeral signature,
and you then sign it and forward it to someone else, the final
recipient cannot verify that the original message came from me or that
you did not alter it.  GPG signatures do give all future recipients
that ability, though I would suggest it is unnecessary for ordinary
email.

-- 
Seth Goodman