Subject: RE: [Asrg] 0. General - IPR - Patents on C/R

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 16 Dec 2003 06:32:50 -0800

The C/R mechanism was used for sender authetication in the MIT AI Lab
COMLINK system used to host Vice President Al Gore's Open Meeting in 1994.
The mechanism was designed and implemented much earlier though - 1993.

The same mechanism was used by Nathaniel Borenstein as a mail filter in 1994
and as a payments mechanism (Green Commerce/First Virtual).

The application to spam is obvious and utterly anti-social. Best thing that
can happen here is for the patent to kill this obnoxious and clueless
mechanism. 

	Phill

> -----Original Message-----
> From: Yakov Shafranovich [mailto:[email-masked]]
> Sent: Thursday, December 11, 2003 10:02 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Asrg] 0. General - IPR - Patents on C/R
> 
> 
> [Subject changed as per posting guidelines, was "Re: [Asrg] 2 
> Questions: 
> History of "Challenge-Response" SPAM filter and Info re. 
> Julian Byrne". 
> Mod.].
> 
> See the following link:
> 
> http://www.solidmatrix.com/research/asrg/asrg-ipr.html
> 
> Gilman Research Services wrote:
> > Hello,
> > 
> > I am a patent researcher conducting research into the history of
> > "Challenge-Response" SPAM filters and would appreciate any 
> assistance or
> > guidance you can provide. I apologize if this is not 
> exactly in keeping with
> > the list's posting guidelines.
> > 
> > 1) I believe I am up to date on the current status of 
> "Challenge-Response"
> > SPAM filters but seem to have hit a dead end re. the history of the
> > strategy.  Most references go back as far as 1996 and 1997 
> with newsgroup
> > postings by Julian Byrne on the topic, i.e., 
> "challenge-response antispam
> > 'bot (CRABS) and others.  Can anyone provide me with any additional
> > references that pre-date 1997?
> > 
> > 2) Secondly, does anyone have any additional information 
> re. Julian Byrne?
> > There appears to be no posting by the professor after 1998 
> and he is no
> > longer at Monash University in AU. Again and information would be
> > appreciated.
> > 
> > Thank you in advance for your patience and time.
> > 
> > Sincerely,
> > 
> > Norm Gilman
> > Gilman Research Services, LLC
> > 
> > 
> > 
> > 
> > _______________________________________________
> > Asrg mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/asrg
> > 
> 
> -------
> Yakov Shafranovich / asrg <at> shaftek.org
> SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
> "Among all our enemies / The ones to be most feared are often the 
> smallest" (Jean de la Fontaine)
> -------
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Philip Miller <[email-masked]>
Date: Tue, 16 Dec 2003 20:20:54 -0500

[changed subject to reflect where this is going]

Hallam-Baker, Phillip wrote:
> [snip history]

The problem with general C/R is that it's trying to achieve two separate
purposes. It's doing return-path verification, and it's doing 
sentient-sender verification. Return-path verification is not inherently 
anti-social, so long as it doesn't necessarily bother the original sender 
(pick your own definition of 'bother'). Sentient-sender verification is 
quite reasonably considered inherently anti-social by some.

Return-path verification definitely has some value, but we need to work out 
a standardized way of doing it. We would never accept that a TCP connection 
is valid after receiving only the SYN packet, so why should we accept it for 
email?
Proposals like CRI could be used to provide end-to-end return-path 
verification by automatically ACKing the challenge, assuming that it only 
asks 'did you send something?', not 'did you, as a sentient being, send 
something?'.

I'm not going to comment on the technical merits of sentient-sender 
verification because it is inherently a social problem that we're not tasked 
to deal with.

Philip Miller

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Dec 2003 20:33:32 -0500

Philip Miller wrote:
> anti-social, so long as it doesn't necessarily bother the original 
> sender (pick your own definition of 'bother'). Sentient-sender 
> verification is quite reasonably considered inherently anti-social by some.
> 
> Return-path verification definitely has some value, but we need to work 
> out a standardized way of doing it. We would never accept that a TCP 
> connection is valid after receiving only the SYN packet, so why should 
> we accept it for email?
> verification by automatically ACKing the challenge, assuming that it 
> only asks 'did you send something?', not 'did you, as a sentient being, 
> send something?'.
> 
> verification because it is inherently a social problem that we're not 
> tasked to deal with.
> 

There is also concern with C/R about doing it inband such as via email 
headers in CRI. Something out of band, such as a CRI ESMTP extension, 
would be much more useful and less intrusive to users. Of course 
dictionary attacks become easier with that unless some kind of a token 
is send with the message initially.

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------