Re: Authentication and email

[Eric Rescorla <ekr@rtfm.com>]

Paul Hoffman / IMC <phoffman@imc.org> writes:
> At 5:15 PM +0200 1/28/03, Gonzalo Camarillo wrote:
> >And after giving them those speeches, we come back "home" to the IETF
> >and say that email security is undoable for our mailing lists for some
> >reason... it seems that MUSTs, SHOULDs and security considerations
> >sections do not apply to us ;o)
>
> This is an absurd argument. The security you are trying to achieve in
> 3GPP is completely unrelated to spam prevention.
>
> I assume that anyone who is advocating using S/MIME or PGP for
> spam-reduction has never used either protocol on a daily basis for
> mail filtering. And I say this as one of the strongest public
> proponents of those protocols. S/MIME and PGP are used for
> authenticating the content of the messages, not for authenticating
> the sender.
I'm not sure how you're drawing the distinction between providing
authentication for content and for senders. Certainly, one of the
services that S/MIME and PGP offer is data origin authentication.
Moreover, its hard to understand what the difference between
these two properties is.

-Ekr

-- 
[Eric Rescorla                                   ekr@rtfm.com]
                http://www.rtfm.com/