CRISP

• Boring -- still disconnect between different camps but work proceeds anyway

MASS: Message Authentication Signature Service

• Eric Allman presented
• Base draft -- good summary

Basic idea: A header in an email message will contain a message signature from the domain sending the message. Thus, this doesn't change the message body (backwards compatibility) and it doesn't involve use of PKI or other key exchange infrastructure that we don't already have. To check the key, clients pull the domain cert from a well-known service in DNS.

• Concerns that this is a major new load for DNS because the multiple-keys-per-domain essentially allows one key per user, or even one key per user per month or other such things.
• Replay attacks explicitly considered OK by authors and no defense against.
• Concerns about repudiation.
• Doesn't prevent spam (except with forged addresses); may prevent phishing in some cases. This is based on the reasoning that preventing forgery will reduce spam and phishing. Ekr questions that reasoning.
• Lots of discussion about whether we should charter something that might not be useful but enough people think could be useful to work on.
• Questions raised about whether this will cause harm to the email infrastructure

Misc

• i18n email addresses