Subject: Re: signed e-mail

From: Aram Perez <[email-masked]>
Date: Sun, 11 Nov 2001 07:12:04 -0800

On Friday, November 9, 2001, at 09:34  AM, Rob G Weemhoff wrote:

> To start with, why are we, as security advocates, not all using signed
> e-mail?

Because we are humans and we trust the Internet mail system. With all 
the respect they are due, you can tell the emails that come from Bob 
Juneman, Lynn Wheeler, Peter Gutman, Peter Williams, Steve Kent and 
others and hence we have an implicit way of verifying and trusting that 
the emails did actually come from those persons. And this implicit 
verification and trust has nothing to do with any type of PKI.

Just my opinion,
Aram Perez

---

From: Michael Ströder <[email-masked]>
Date: Mon, 12 Nov 2001 11:00:46 +0100

"Khaja E. Ahmed" wrote:
> 
> 1.) Benefit.  It adds too little value in the instance being discussed. The
> infrastructures is not quite there yet so proper and complete path
> validation not always possible.  The certificates are not interoperable
> enough in practice. There is frequently no way of checking revocation
> status.
> 2.) Cost.  It has not crossed the threshold of being easy enough to use all
> the time, even by the judgment of security experts.
> 
> I happen to agree with this view for signed email on this list.
> 
> What worries me however is that in discussions with senior management and
> CIOs of 4 B2B exchanges (2 of them big name) this argument was applied to
> signed transactions that are valued at $1M average. Surprisingly, even the
> point that Adam Perez makes about being able to recognize "implicitly" who
> wrote the email was applied to purchase orders and reverse auctions.

It's just a matter of risk managment. It's up to the application
owner to decide if he wants to live with that risk or not. In most
cases there is in fact a human being processing the transaction and
validating the request. Especially when it comes to the $1M range.

Ciao, Michael.