Dear Colleagues, [apologies for duplicate messages] The MAIL-FROM authentication scheme is very weak. Forging RFC2822 headers can be done very easily. With the existence of more secure "auth" schemes in the RIPE Database, it does not make much sense to support it any more. The proposal to phase out the MAIL-FROM authentication scheme was presented to the to the Database Working group. You may find the original proposal at http://www.ripe.net/ripe/mail-archives/db-wg/20020101-20020401/msg00066.html The timeline for this transition presented below was discussed and approved at the RIPE 42 meeting. Please see the minutes of the DB-WG session http://www.ripe.net/ripe/wg/db/minutes/ripe-42.html. To make this transition more smooth we prepared a page with step by step instructions how to update the mntner objects to remove the MAIL-FROM auth scheme. It can be found at http://www.ripe.net/db/MD5-HOWTO.html Regards, Andrei Robachevsky DB Group Manager RIPE NCC Transition phases ================== Use of MAIL-FROM is phased out in four steps, on the following dates: Phase 1: 16 May 2002 - 12 June 2002 Notifying mntners with MAIL-FROM auth scheme -------------------------------------------- An announcement presenting this transition and encouraging the owners of the mntners to remove MAIL-FROM auth scheme from their objects will be sent on 16 May, 2002. The announcement will point to instructions how to update the mntner objects to remove the MAIL-FROM auth scheme. The distribution list will be compiled from e-mail addresses listed in "upd-to:", "mnt-nfy:" attributes of the mntners, as well as using contact information (e-mail) from "admin-c:" and "tech-c:" references. Phase 2: 13 June 2002 - 10 July 2002 Rejecting updates for mntner objects containing MAIL-FROM auth scheme --------------------------------------------------------------------- When updating maintainers the new version must not contain MAIL-FROM "auth:" attributes, otherwise this will be reported as a syntax error. This means that you cannot create any new MAIL-FROM "auth:" attributes, either in new or existing maintainers. Phase 3: 11 July 2002 - 7 August 2002 Rejecting using the MAIL-FROM auth scheme for authorisation ----------------------------------------------------------- When processing an update for an object protected by a mntner that contains MAIL-FROM auth scheme, this scheme will be ignored. That means that if mntner defines other auth schemes different from MAIL-FROM, the credentials relevant to these schemes may be used. If the only auth scheme defined is MAIL-FROM, no update can be authorised by such mntner. Phase 4: 8 August 2002 Cleanup ------- The mntners still containing "auth:" attribute with the MAIL-FROM auth scheme will be modified so that such attributes will be removed from the objects. Before this a final call will be sent to the owners of these mntners ("upd-to:", "mnt-nfy:" attributes of the mntners, as well as to the contacts from "admin-c:" and "tech-c:" references). A "remarks:" attribute will be added with clear explanation of the situation. In case a mntner contains only one "auth" scheme, which is MAIL-FROM, it will be locked and cannot be used by the owner.