mainClasspath Extensions - Support: sr #103418, RFE: add a security reporting...

 
 

sr #103418: RFE: add a security reporting feature in STARTTLS case

Submitter:  Ralf Hauser <ralfhauser>
Submitted:  Thu 30 Sep 2004 09:24:09 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  1 - Wish Status:  None
Privacy:  Public Assigned to:  conradpino
Open/Closed:  Open Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 27 Oct 2013 08:58:00 PM UTC, comment #2: 

As this request remains unaddressed 9+ years hence, I suggest the Subject has limited application and current project resources seem occupied elsewhere.

May I suggest either (1) downloading and revising the code or (2) submitting a code patch for project review?  In any case I shall close this issue 30 days hence as "Wont Do" if there is no further interest expressed.

Conrad T. Pino <conradpino>
Group Member
Thu 30 Sep 2004 01:27:50 PM UTC, comment #1: 

further audit evidence that might be of interest is whether a revocation authority has been consulted or not (OCSP or CDP as per http://www.betrusted.com/downloads/products/keytools/v50/pro/c-docs/html/refguide/Certificates/CRLDistributionPointExten.html)

Ralf Hauser <ralfhauser>
Thu 30 Sep 2004 09:24:09 AM UTC, original submission:  

When trying to use mail in a financial services environment, more and more, email needs to be fully auditable to be compliant.
Therefore, also a sender must be able to produce detailed evidence after the fact that mail submissions have been executed with due care.

Therefore, I suggest to add a new "mail.smtp.report" attribute that reports on at least the level "basic" and "advanced" what it did:

  • E.g. "basic" could report in a single line

- certificate domain, key size, expiration, issuing CA, as well as the stream cipher employed (e.g.: was it only 40 bit?)

  • "advanced" would also provide the certificates used in full, and possibly the session key (for later recovery of an archived transmission cryped stream in case DHE), size of transmission, etc.


A first step would be to simply print that "accountability info" to stdout/stderr, later the javamail API hopefully eventually will provide an extended transport.send() interface to return such audit related objects.

Related are https://bugzilla.mozilla.org/show_bug.cgi?id=227096
and https://bugzilla.mozilla.org/show_bug.cgi?id=227097

Ralf Hauser <ralfhauser>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by conradpino (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-10-27 conradpino Assigned toNone conradpino

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code