Re: [9fans] cryptographic signatures & factotum

["Steve Simon" <plan9fans@ntlworld.nospam.com>]

Hi,

Thanks to all who replied.
I realised I didn't say why I want to do this.

At work my plan9 system is very carefully screened behind a
firewall. The only way I can make somthing happen on it is
either cron or emai (via pipeto).

My idea was to send just a plaintext email that contains two attachements.
One being an rc script and the other an authenticating
signature for that command. I think this is secure enough as the
signature (hash) would need a shared secret to be validated.

The idea of hashing a sequence count is interesting but in the context
of email as a transport (and our unreliable pop3 server) I am wary of
going down this route.

The real questions are:
Should I attempt to add a non-standard (not PGP) signature verification
algorithm to factotum? Or, should I just do a quick bodge and not
worry, because no-one else would ever want such a thing?

Another question:

At home my plan9 system is straight onto broadband but I believe it's
secure - it only listens on the cpu and exportfs, am I being naieve (again
:-), tell me I don't need to buy a firewall...

-Steve