Status: Board Rejected
Formal introduction on PPML on 16 February 2007Staff assessment - 13 April 2007
Last call - 25 April through 9 May 2007 Public Policy Mailing List
ARIN Public Policy Meeting:ARIN XIX
ARIN Advisory Council:2 November 2006
16 November 2006
18 January 2007
15 February 2007
24 April 2007
17 May 2007
ARIN Board of Trustees:Cryptographic Authentication
Proposal type: New
Policy term: Permanent
DELETION FROM THE NRPM
This section intentionally left blank.
ADDITION TO THE NRPM
Mail-From is the default authentication method by which registration records are protected from vandalism. If a registrant fails to designate a more secure method, any subsequent email which bears the sender address of an authorized Point of Contact may be deemed authentic with regard to the registrant's records. Since it is trivial to forge a sender address, Mail-From should not be regarded as secure. Use of Mail-From authentication is not recommended to any registrant who has the means to implement either of the more secure cryptographic authentication methods.
This policy complements the previously-proposed "Reinstatement of PGP Authentication Method" which introduces section 12 to the NRPM. Section 12 relates the existence of three authentication methods. Two of those, mail-from and X.509, were preexisting but not documented within the NRPM.
This policy proposal simply seeks to provide brief documentation of the existence of the mail-from authentication method. Because the specific wording of the documentation may be subject to debate, and is in no way interdependent upon the documentation of the other two methods, it is being proposed in a separate policy, so that consensus may be more easily reached.
Timetable for implementation: Immediate