🚀 go-pugleaf

In article <1992Oct13.172459.28720@zip.eecs.umich.edu>, ayman@eecs.umich.edu (Ayman I. Kayssi) writes:
|> I posted a question on comp.unix.questions about how to get a shell by email,
|> that is a shell that would execute what's in the body of an email message.
|> All the details have been worked out except for one thing: security.
|> Currently, security is obtained using the following:
|> 1- the subject of the message is a certain (fixed) special string
|> 2- a header line is added which contains an encrypted string
|> You can see that the problem is that the message itself contains the security
|> keys, and therefore anyone can intercept the email and fake a message...
|> So, are there any suggestions on how to make this more secure?
|> Email or post...
|> Thanks,

How about running a unique checksum algorithm on the message (including
the source and destination addresses) and appending the result on the end
of the message.  Only the sender and receiver know the algorithm, and so
a third party could not construct a false message without knowing (or
stealing) the checksum algorithm.  

For extra points, change the algorithm periodically.

-- 
All opinions made from fresh ingredients.  No official additives.
                         ______  ______  ______
Marc Brett               \     \/     /\/     /\
Computer Science Dept.    \    /     / /     /  \ 
brett@wg.waii.com          \  /     / /     /    \    WESTERN
VOICE: (713) 963-2311       \/_____/\/_____/\_____\   GEOPHYSICAL
                          W e s t e r n   A t l a s   10001 Richmond Ave
                          I n t e r n a t i o n a l   Houston, TX 77042