0

X works for EvilCorp and he sends a whistleblowing email to HR. HR responds with "we will look into it". But management takes advantage of having control over X's PC and all email addresses and formats the PC and deletes mails from the server. X has downloaded a copy of the raw email which he had emailed to another employee.

Can X prove the sender, time and contents by possessing the raw email which has ARC headers? Can he prove sender and time by possessing the header alone, like he had to take a photo of whats a long raw email?

1 Answer 1

1

X can probably prove those things the headers, but you'll need the whole message so the cryptographic proofs can be verified.

You're mentioning ARC, which unfortunately requires a bit of trust, so it depends on who signed what. X should have a cryptographic signature from the ARC signer, which might be good enough assuming that comes from Google or something internal to the company, since that means the ARC signer received the message with a valid DKIM signature. It's also possible that the DKIM signature itself, which I assume is what you're seeking, is intact enough (e.g. if you revert any Subject or body alterations to how they looked when X sent the message, it's likely to pass DKIM). If the DKIM signature can't be vetted, you must rely on the ARC signature and therefore you must trust that additional infrastructure.

Armed with ARC from a trusted party or a valid DKIM signature, you can prove at least that the message passed through the DKIM-signing relay with the given DKIM-signed headers (h=…), which should include the Date, To, Subject, From, and a hash of the body (b=…).

For X to prove a DKIM match, all signed portions of the message must be provided unmolested (this includes each header in the h=… part plus the body if there's a b=… part). ARC merely signs the Authentication-Results header, but it's still best if you provide the whole email.

This might be complicated if there's confidential content in the body, but perhaps you can use the body hash instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .