SELS: a secure e-mail list service

ABSTRACT

Exchange of private information content among a large number of users via E-mail List Services is becoming increasingly common. In this paper we address security requirements in that setting and develop a new protocol, SELS (a Secure E-mail List Service) that provides confidentiality, integrity, and authentication for e-mails exchanged via lists. In addition, SELS also protects against the use of lists for e-mail spamming. We have developed a prototype of SELS in Java, and integrated it with the Eudora e-mail client.

REFERENCES

• 1: Martín Abadi , Neal Glew, Certified email with a light on-line trusted third party: design and implementation, Proceedings of the 11th international conference on World Wide Web, May 07-11, 2002, Honolulu, Hawaii, USA [doi>10.1145/511446.511497]
• 2: M. Abadi, A. Birrell, M. Burrows, F. Dabek, and T. Wobber, "Bankable Postage for Network Services", in Proceedings of the 8th Asian Computing Science Conference, Mumbai, India, December 2003.
• 3: J. Allen, The CERT Guide to System and Network Security Practices, Carnegie Mellon Software Engineering Institute, Addison Wesley, Indianapolis, 2001. ISBN 0-2-1-73723-X.
• 4: Ion Androutsopoulos , John Koutsias , Konstantinos V. Chandrinos , Constantine D. Spyropoulos, An experimental comparison of naive Bayesian and keyword-based anti-spam filtering with personal e-mail messages, Proceedings of the 23rd annual international ACM SIGIR conference on Research and development in information retrieval, p.160-167, July 24-28, 2000, Athens, Greece [doi>10.1145/345508.345569]
• 5: Ross J. Anderson , Roger M. Needham, Robustness Principles for Public Key Protocols, Proceedings of the 15th Annual International Cryptology Conference on Advances in Cryptology, p.236-247, August 27-31, 1995
• 6: M. Bellare, R. Canetti, and H. Krawczyk, "Message authentication using hash functions: The HMAC construction", RSA Laboratories' CryptoBytes, Vol. 2, No. 1, Spring 1996.
• 7: M. Blaze, G. Bleumer, and M. Strauss, "Divertible protocols and atomic proxy cryptography", in Eurocrypt'98, LNCS 1403, Springer-Verlag, 1998.
• 8: Carlo Blundo , Stelvio Cimato , Roberto De Prisco, Certified Email: Design and Implementation of a New Optimistic Protocol, Proceedings of the Eighth IEEE International Symposium on Computers and Communications, p.828, June 30-July 03, 2003
• 9: D. Boneh, X. Ding, G. Tsudik and B. Wong, "Fast Revocation of Security Capabilities", in Proceedings of the Usenix Security Symposium, August 2001.
• 10: Dan Boneh , Matthew Franklin, Identity-Based Encryption from the Weil Pairing, SIAM Journal on Computing, v.32 n.3, p.586-615, 2003 [doi>10.1137/S0097539701398521]
• 11: Catalist, the official catalog of LISTSERV lists, http://www.Isoft.com/catalist.html.
• 12: Richard Clayton , Mike Bond, Experience Using a Low-Cost FPGA Design to Crack DES Keys, Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems, p.579-592, August 13-15, 2002
• 13: Lorrie Faith Cranor , Brian A. LaMacchia, Spam!, Communications of the ACM, v.41 n.8, p.74-83, Aug. 1998 [doi>10.1145/280324.280336]
• 14: X. Ding and G. Tsudik, "Simple Identity-Based Cryptography with Mediated RSA", in Proceedings of the RSA Conference, Cryptographer's Track, 2003.
• 15: Cynthia Dwork , Moni Naor, Pricing via Processing or Combatting Junk Mail, Proceedings of the 12th Annual International Cryptology Conference on Advances in Cryptology, p.139-147, August 16-20, 1992
• 16: C. Dwork, A. Goldberg, and M. Naor, "On Memory-Bound Functions for Fighting Spam", in advances of Cryptology (CRYPTO 2003,) August 2003.
• 17: Eran Gabber , Markus Jakobsson , Yossi Matias , Alain J. Mayer, Curbing Junk E-Mail via Secure Classification, Proceedings of the Second International Conference on Financial Cryptography, p.198-213, February 23-25, 1998
• 18: T. E. Gamal, "A Public Key Cryptosystem and a Signature Scheme Based on the Discrete Logarithm", IEEE Transactions of Information Theory, pages 31(4): 469--472, 1985.
• 19: The GNU Privacy Guard, http://gnupg.org.
• 20: J. loannidis, "Fighting spam by encapsulating policy in email addresses", in Proceedings of the Symposium on Network and Distributed Systems Security, 2003.
• 21: A. Ivan and Y. Dodis, "Proxy Cryptography Revisited", in Proceedings of the Network and Distributed System Security Symposium (NDSS), February 2003.
• 22: Yongdae Kim , Adrian Perrig , Gene Tsudik, Simple and fault-tolerant key agreement for dynamic collaborative groups, Proceedings of the 7th ACM conference on Computer and communications security, p.235-244, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352638]
• 23: J. Linn, "Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication Procedures", IETF PEM WG RFC 21, 1993.
• 24: LISTSERV, http://www.Isoft.com.
• 25: Thede Loder , Marshall Van Alstyne , Rick Wash, An economic answer to unsolicited communication, Proceedings of the 5th ACM conference on Electronic commerce, May 17-20, 2004, New York, NY, USA [doi>10.1145/988772.988780]
• 26: Mailman, the GNU mailing list manager. http://www.list.org.
• 27: Majordomo, http://www.greatcircle.com/majordomo.
• 28: M. Mambo and E. Okamoto, "Proxy Cryptosystems: Delegation of the Power to Decrypt Ciphertexts", IEICE Transactions on Fundamentals, vol. E80-A, No. 1, 1997.
• 29: Suvo Mittra, Iolus: a framework for scalable secure multicasting, Proceedings of the ACM SIGCOMM '97 conference on Applications, technologies, architectures, and protocols for computer communication, p.277-288, September 14-18, 1997, Cannes, France
• 30: Ostermiller Java Utilities, http://ostermiller.org/utils.
• 31: T. Tompkins and D. Handley, "Giving e-mail back to the users: Using digital signatures to solve the spam problem", First Monday, 8(9), September 2003.
• 32: US Department of Energy Computer Incident Advisory, January 26 2000. http://ciac.llnl.gov/ciac/bulletins/k-020.shtml.
• 33: Chung Kei Wong , Mohamed Gouda , Simon S. Lam, Secure group communications using key graphs, IEEE/ACM Transactions on Networking (TON), v.8 n.1, p.16-30, Feb. 2000 [doi>10.1109/90.836475]
• 34: Philip R. Zimmermann, The official PGP user's guide, MIT Press, Cambridge, MA, 1995

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General

Keywords:
electronic mail, mailing list, security