Re: CBV

In <[email protected]> Mark Shewmaker <[email protected]> writes:

>
> Could the SES address contain a truncated body checksum?  [...]
>
> Even a truncated body checksum could help against that sort of replay
> attack.

You would have to make sure that you didn't truncate the checksum too
short.  If a spam has 20 lines in it and you have a 20bit checksum, you
can create 2^20 variations of the spam by simply adding or deleting a
space at the end.  Spammers can use to hundreds of thousands of
trojaned PCs to do this kind of calculation.

Then you also have the problem of things like mailing lists or MS
Exchange munging the email, thus causing the checksum to fail.


-wayne