Message Authentication Signature Standards (MASS) BOF Jim Fenton Nathaniel Borenstein

MASS BOF - Motivation Deny spammers/phishers/etc. the ability to send mis-identified mail Authorization based on IP address is being addressed by MARID Other approaches based on signatures in messages are out-of-scope for MARID

MASS relationship to MARID MARID: –Authorization based on IP address –Authorization records stored in DNS –Cryptographic approaches out-of-scope MASS: –Message authentication based on cryptographic signature –Authorization of key (and often key itself) May be stored in DNS May be a separate server

Potential commonalities between MASS and MARID Definition of Purportedly Responsible Address (PRA) Message marking to indicate successful/unsuccessful verification Eventual use of accreditation infrastructure –Although what’s being accredited may differ

Representative proposals DomainKeys –draft-delany-domainkeys-core-00 Identified Internet Mail –draft-fenton-identified-mail-00 Postmarks – Entity-to-entity S/MIME –draft-hallambaker-entity-00 MTA Signatures – Bounce Address Tag Validation – 06dc.htmlhttp://brandenburg.com/specifications/draft-crocker-marid-batv dc.html

Some potential issues Signature encapsulation –Signatures in headers –S/MIME Key management Canonicalization –What’s required to avoid signature breakage? –Treatment of headers Behavior through mailing lists

Where and when? Thursday, August :30 am (some agendas say 9:30) Marina 2 Mailing list: –Archive at