1

Let's assume my professor sends a signed but unencrypted (S/MIME) e-mail to us students like this:

Dear students,

there will be no class tomorrow. I'm sick.

Regards Professor

Now I could simply replay this mail next month to my fellow students and my professor would be the only one showing up in the class room. All the other students would believe this mail is valid, since it is still signed (by my professor) and sent via a faked sender address.

My idea is, that this e-mail should have been addressed to a specific recipient ( Dear student A.. ). This way each recipient can simply proof via plaintext, if this mail is addressed to him/her.

Is it correct, that sending trivial signed but unencrypted (or encrypted-then-signed) mails like this should be avoided, since it could be turned against you?

4

If the email was addressed to a specific student, the same replay attack would be possible if you intercepted the email in transit.

The problem with this email is not the vagueness of the recipient, it's the vagueness of the content. It doesn't specify what "tomorrow" is. Would the email read "there will be no class on December 8th 2017", this "replay attack" would be foiled.

It could also be foiled if S/MIME would include the mail header with the date. There is a standardized way to do that since S/MIME 3.1 (embedding the message in another message as the message/rfc822 media type). The recipient would then see that it is an old email and that it is addressed to someone else (unless it's an email with multiple recipients). But I am not sure how well this is supported by email clients.

By the way, in my opinion it should be common etiquette in email communication to avoid relative dates for a completely different reason: you can't tell when the recipient reads your email. When the recipient reads the mail tomorrow morning and doesn't check when it was sent, then they will believe that "tomorrow" refers to what you would have considered "the day after tomorrow". This problem is amplified if you are in different timezones. Your "tomorrow morning" might be your recipients "this evening".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.