Guest Blogger Jim Fenton: “Mail Authentication as a Peephole”
This entry is from guest blogger Jim Fenton. Fenton is a Distinguished Engineer in the Security Technology Group at Cisco. Even though Cisco isn’t an e-mail vendor, it’s beneficial to users of the Internet (and therefore strategic to Cisco) to improve the accountability for Internet messages. That’s the reason that Cisco has been active in co-developing and standardizing DomainKeys Identified Mail (DKIM), an e-mail authentication technology based on cryptographic signatures. The new DKIM Working Group will hold its first meetings at the IETF meeting in Dallas March 20-24.The question many people ask, and one of the hurdles in getting the working group chartered, is,”What good is e-mail authentication, anyway? It won’t stop spam and phishing!” Indeed it won’t; spammers and phishers will sign their own messages, most likely using throw-away e-mail domains they register for a single use. The same is true for other methods of e-mail authentication, such as Sender ID Framework and SPF. In fact, many spammers were early adopters of SPF, and I expect that they will be early DKIM adopters as well.The similarity that works well for me is that of a peephole in your front door or hotel room door. When there’s a knock at the door, you look out. If you recognize the person and it’s a friend, you open the door and let them in. If it’s someone who looks sinister (or a landshark!) then you don’t. If it’s someone you just don’t recognize, you use additional means of identification: perhaps you ask them via an intercom who they are and what their business is. Do peepholes unambiguously identify everyone? No. The same is true for e-mail authentication. This is not a problem with peepholes or e-mail authentication, but simply that they aren’t intended to be used in a vacuum.This is a policy blog, so what’s the policy angle on this? In the same sense that governments shouldn’t mandate the authentication of callers at your front door, they shouldn’t mandate e-mail authentication (and especially the use of specific technologies). It’s entirely reasonable to advocate the use of authentication technologies, much as they do in recommending the use of peepholes. To push the metaphor further, just as peepholes, intercoms, and video cameras all may have a role in authenticating callers, the various e-mail authentication technologies all provide some information that may be useful to the recipient, and two or more technologies may be used together. It should be up to the recipient what forms of authentication they use. Callers (message senders) will quickly learn what they need to do in order to be recognized.