Re: [9fans] ISP filtering - update

[David Presotto <presotto@closedmind.org>]

[-- Attachment #1: Type: text/plain, Size: 977 bytes --]

-> random1
<- random2, hmac(random1, shared key)
-> hmac(random2, shared key)

This is incredibly weak authenitcation (susceptible to main in the middle)
but works if all you're trying to do is keep out spammers who ar just
injecting messages from their home machines.  They can't authenticate
without knowing the shared key.

The problem is always how many shared keys are there.  You could have
one per pair of communicating individuals but then you need an introduction
protocol.  You could have a trusted third party to automate that
introduction and you've essentially got plan 9's authentication protocol
(we mix with DES rather than a keyed hash but its pretty much the same).

Public keys have the advantage that the amount of cruft kept secret
is small, i.e., your own private key part and nothing else.  You don't
need cert's per se.  Just a place to get public keys that you trust.
That could be a place that just has to be kept secure, not secret.

[-- Attachment #2: Type: message/rfc822, Size: 2875 bytes --]

From: "boyd, rounin" <boyd@insultant.net>
To: <9fans@cse.psu.edu>
Subject: Re: [9fans] ISP filtering - update
Date: Fri, 26 Sep 2003 14:14:13 +0200
Message-ID: <063c01c38427$b3339900$b9844051@insultant.net>

> SMTP mostly comes from providers (ISP's) and not your friends (unless
> your friends happen to own ISP's).

yup, i'm thinking about a clever auth method based on a cryptographic hash:

    - 'public key' is some random string
    - shared secret is a shared string
    - cat the two and hash them

i need to think about this more.

i don't care about encryption.  i want authentication [ZKP]. reading
_network security_ i see the example is based on transforms on large
graphs.

the public key is a list of large [500 node] graphs while the private key
is the transform between randomly chosen graphs and an isomorphic
graph.  as the doc says 'this is impracticle'.

then i started to think about graphs.  now, what is the web?

this is all probably flawed, but i haven't given up yet.  buddy, can you
spare a neuron?