Some common attacks against certified email protocols and the countermeasures

摘要

Certified email is a value-added service for standard email systems, which guarantees the fairness, i.e., the intended recipient gets the mail content if and only if the mail originator receives a non-repudiation receipt showing that the message has been received by the recipient. As far as security is concerned, fairness is the most important requirements, though some other properties are also desirable in practice. Recently, a number of certified email protocols have been proposed. However, most of those schemes have more or less weaknesses and/or security flaws. In the worst case, fairness cannot be achieved since one dishonest party can mount some attacks to cheat the honest party such that the latter cannot get the expected items. In this paper, we analyze two latest certified email protocols to demonstrate some common attacks, and then propose some improvements to avoid those security problems. We further give several informal but useful guidelines to counter those common attacks in the design of certified email protocols.