helpClasspath Extensions - Support: sr #103418, RFE: add a security reporting...

 
 

sr #103418: RFE: add a security reporting feature in STARTTLS case

Submitted by:  Ralf Hauser <ralfhauser>
Submitted on:  Thu 30 Sep 2004 09:24:09 AM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 1 - WishStatus: None
Privacy: PublicAssigned to: Conrad T. Pino <conradpino>
Open/Closed: OpenOperating System: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 27 Oct 2013 08:58:00 PM UTC, comment #2:

As this request remains unaddressed 9+ years hence, I suggest the Subject has limited application and current project resources seem occupied elsewhere.

May I suggest either (1) downloading and revising the code or (2) submitting a code patch for project review? In any case I shall close this issue 30 days hence as "Wont Do" if there is no further interest expressed.

Conrad T. Pino <conradpino>
Project MemberIn charge of this item.
Thu 30 Sep 2004 01:27:50 PM UTC, comment #1:

further audit evidence that might be of interest is whether a revocation authority has been consulted or not (OCSP or CDP as per http://www.betrusted.com/downloads/products/keytools/v50/pro/c-docs/html/refguide/Certificates/CRLDistributionPointExten.html)

Ralf Hauser <ralfhauser>
Thu 30 Sep 2004 09:24:09 AM UTC, original submission:

When trying to use mail in a financial services environment, more and more, email needs to be fully auditable to be compliant.
Therefore, also a sender must be able to produce detailed evidence after the fact that mail submissions have been executed with due care.

Therefore, I suggest to add a new "mail.smtp.report" attribute that reports on at least the level "basic" and "advanced" what it did:

  • E.g. "basic" could report in a single line

- certificate domain, key size, expiration, issuing CA, as well as the stream cipher employed (e.g.: was it only 40 bit?)

  • "advanced" would also provide the certificates used in full, and possibly the session key (for later recovery of an archived transmission cryped stream in case DHE), size of transmission, etc.

A first step would be to simply print that "accountability info" to stdout/stderr, later the javamail API hopefully eventually will provide an extended transport.send() interface to return such audit related objects.

Related are https://bugzilla.mozilla.org/show_bug.cgi?id=227096
and https://bugzilla.mozilla.org/show_bug.cgi?id=227097

Ralf Hauser <ralfhauser>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by conradpino (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 27 Oct 2013 09:19:15 PM UTCconradpinoAssigned toNone=>conradpino

    Back to the top


    Powered by Savane 3.1-cleanup