mainClasspath Extensions - Support: sr #103418, RFE: add a security reporting...

 
 

sr #103418: RFE: add a security reporting feature in STARTTLS case

Submitter:  Ralf Hauser <ralfhauser>
Submitted:  Thu 30 Sep 2004 09:24:09 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  1 - Wish Status:  None
Privacy:  Public Assigned to:  conradpino
Open/Closed:  Open Operating System:  None
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Sun 27 Oct 2013 08:58:00 PM UTC, comment #2: 

As this request remains unaddressed 9+ years hence, I suggest the Subject has limited application and current project resources seem occupied elsewhere.

May I suggest either (1) downloading and revising the code or (2) submitting a code patch for project review?  In any case I shall close this issue 30 days hence as "Wont Do" if there is no further interest expressed.

Conrad T. Pino <conradpino>
Group Member
Thu 30 Sep 2004 01:27:50 PM UTC, comment #1: 

further audit evidence that might be of interest is whether a revocation authority has been consulted or not (OCSP or CDP as per http://www.betrus ... onPointExten.html)

Ralf Hauser <ralfhauser>
Thu 30 Sep 2004 09:24:09 AM UTC, original submission:  

When trying to use mail in a financial services environment, more and more, email needs to be fully auditable to be compliant.
Therefore, also a sender must be able to produce detailed evidence after the fact that mail submissions have been executed with due care.

Therefore, I suggest to add a new "mail.smtp.report" attribute that reports on at least the level "basic" and "advanced" what it did:

  • E.g. "basic" could report in a single line

- certificate domain, key size, expiration, issuing CA, as well as the stream cipher employed (e.g.: was it only 40 bit?)

  • "advanced" would also provide the certificates used in full, and possibly the session key (for later recovery of an archived transmission cryped stream in case DHE), size of transmission, etc.


A first step would be to simply print that "accountability info" to stdout/stderr, later the javamail API hopefully eventually will provide an extended transport.send() interface to return such audit related objects.

Related are https://bugzilla. ... bug.cgi?id=227096
and https://bugzilla. ... bug.cgi?id=227097

Ralf Hauser <ralfhauser>

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by conradpino (Posted a comment)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    History

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-10-27 conradpino Assigned toNone conradpino

    Back to the top

    Powered by Savane 3.16-ed84.
    Corresponding source code