RFC 6590

RFC 6590: Redaction of Potentially Sensitive Data from Mail Abuse Reports 🦋

okay bestie, so this is RFC 6590 💌 It's a Standards Track doc, dated April 2012, with ISSN 2070-1721. The editors are J. Falk of Return Path and M. Kucherawy of Cloudmark, and they're the ones who wrote it up 🫶 The title block doesn't list anything it obsoletes or updates, so this one stands on its own ✨

Abstract

okay so emails can have stuff in them that's private or sensitive, either because a law says so or because it's just not cool to share 🙈 When one of those messages ends up in a report that's gonna get shared with other folks, the person making the report might wanna redact or hide the sensitive bits. This memo suggests one way to do that well 💅

Status of This Memo

this is an Internet Standards Track document 🔥

it's a product of the IETF (Internet Engineering Task Force), and it represents the consensus of the IETF community 👑 it got public review and was approved for publication by the IESG (Internet Engineering Steering Group). If you want more on Internet Standards, check out Section 2 of RFC 5741 📚

info about the current status, any errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc6590 💖

Copyright Notice

Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved 🌈

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date it was published. pls actually read those, bc they spell out your rights and restrictions for this doc 🫶 Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 💀

Table of Contents

1. Introduction ....................................................2
2. Key Words .......................................................3
3. Recommended Practice ............................................3
4. Transformation Mechanisms .......................................4
5. Security Considerations .........................................5
   5.1. General ....................................................5
   5.2. Digest Collisions ..........................................5
   5.3. Information Not Redacted ...................................5
6. Privacy Considerations ..........................................6
7. References ......................................................6
   7.1. Normative References .......................................6
   7.2. Informative References .....................................6
Appendix A. Example ................................................7
Appendix B. Acknowledgements .......................................8

1. Introduction 🎀

so the Abuse Reporting Format [ARF] defines a message format for sending abuse reports around the messaging infrastructure 🌸 The goal is to make it easy to automate both making these reports and reading them 🧚

for privacy stuff, a report generator might have a policy to anonymize or obscure the bits of a report that could identify the end user who set the whole thing off. In feedback loop land, people call this "redaction" 💅 How exactly you do it is left unspecified in [ARF], since it's basically up to your local policy. That spec does warn generators not to go overboard, though, bc hiding too much data makes the report non-actionable 😭

older redaction methods, like swapping the local-part of an address for a uniform string such as "xxxxxxxx", made it super hard to prioritize or group reports 💀 This memo offers a way to redact that still lets a report receiver tell that two reports came from the same end user, without revealing who that user is ✨ So the receiver can look at the redacted string, like a hidden email address, and figure out that two unredacted strings were identical. Basically, the reports originally had the same address 🦋

Generally, the recipient-identifying fields of a message get obscured when they're copied into a report, so the person who complained about the message stays hidden 🫶 But other data is presumed to be left intact, and that data could be matched against log files or other resources to figure out who the original message was sent to 👀

2. Key Words 🔑

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [KEYWORDS] 💜

3. Recommended Practice 💖

when you want redaction, and you want the receiver to be able to link reports that might come from a shared but anonymous source, the report generator SHOULD use the following practice:

1. Pick a transformation mechanism (see Section 4) that's consistent, meaning the same input string gives the same output every single time, and reasonably collision-resistant, meaning two different inputs are unlikely to give the same output 🔥
2. Find the string(s), like the local-parts of email addresses, in a message that need redacting. Call these strings the "private data" 🙈
3. For each piece of private data, apply the mechanism you picked 🧚
4. If the output of the transformation can contain bytes that aren't printable ASCII, or if it can include characters that aren't appropriate to replace the private data directly, encode the output with the base64 algorithm defined in Section 4 of [BASE64], or some similar translation, so it's a valid replacement in the original context. For example, swapping a local-part in an email address for transformation output with an @ character (ASCII 0x40) or a space character (ASCII 0x20) isn't allowed by the local-part spec in [SMTP], so the output has to be encoded like we said 😭
5. Replace each instance of private data with its matching (possibly encoded) transformation when you generate the report. Also, the replaced text could be in a spot with constraints, like length limits, that you need to respect 💅

so the effect is that the data gets hidden, in a way that might be impossible to reverse, but the receiver can still see that loads of reports are about one particular end user 👑 That lets them prioritize their reactions to problems that seem focused on specific end users who might be under attack 🌈

4. Transformation Mechanisms 🦋

this memo doesn't require any particular transformation mechanism 🎀 The interoperability it's going for comes from the transformation being consistent ✨

how secure the transformation is (aka how well it stops people from reversing it) is up to local policy 🔐 There's a whole continuum of options, from trivial stuff like rot13, CRC32, and base64, to strong cryptographic encodings like the Hashed Message Authentication Code [HMAC], and even full encryption. You could also go private, like mapping an email address to an internal customer number 💅 An operator who wants to redact reports has to pick a consistent transformation that hides the private data, and that's resilient enough to stop people from pulling the original data out to the extent their local policy needs. Just keep in mind that the environment the transformation runs in isn't a super secure one 😬 See Section 5.3 for more on this 👀

An implementation MAY choose any transformation that has a reasonably low likelihood of collision 🌸

Appendix A. Example ✨

Okay bestie, let's walk through a full example 🦋. Say this is the input message we're starting with:

From: alice@example.com
To: bob@example.net
Subject: Make money fast!
Message-ID: <123456789@mailer.example.com>
Date: Thu, 17 Nov 2011 22:19:40 -0500

Want to make a lot of money really fast?  Check it out!
http://www.example.com/scam/0xd0d0cafe

So Bob at example.net gets this and reports it as abusive through whatever mechanism his mailbox provider has set up 🙅‍♀️. That kicks off an [ARF] message. BUT example.net doesn't want Bob's email address getting passed along to the scammer, because that could lead to even more trouble for Bob 😭. Protect the bestie!!

So example.net is going to redact the local-part of the recipient address in the To: field 🫶. Its local policy and security requirements say the algorithm known as "H" (a hash of a key concatenated with the data you want to hide) using SHA1 is good enough 💅. It picked the redaction key "potatoes" 🥔, and the private data here is the string "bob". The string "potatoesbob" gets digested with SHA1 and then base64-encoded, which gives us "rZ8cqXWGiKHzhz1MsFRGTysHia4=" ✨. Iconic.

So when example.net builds the ARF message in response to Bob's complaint, the third part of the ARF report uses this version of the received message 👑:

From: alice@example.com
To: rZ8cqXWGiKHzhz1MsFRGTysHia4=@example.net
Subject: Make money fast!
Message-ID: <123456789@mailer.example.com>
Date: Thu, 17 Nov 2011 22:19:40 -0500

Want to make a lot of money really fast?  Check it out!
http://www.example.com/scam/0xd0d0cafe

Heads up, though 🚨: the redacted information might still be recoverable. Agents at example.com could search their logs for the original envelope associated with the message and correlate it with the Message-ID contents, which weren't redacted here 😬. The expectation is that feedback loops generating these reports involve senders that have been vetted against this kind of information leakage 🫠.

---

Appendix B. Acknowledgements 🌸

So much of the text in this document was originally moved over from other MARF working group documents 📚. Huge thank yous to Monica Chew, Tim Draegen, Michael Adkins, and the rest of the Messaging Anti-Abuse Working Group 🫶. Extra feedback came from John Levine, S. Moonesamy, Alessandro Vesely, and Mykyta Yevstifeyev 💜. Iconic squad, honestly.

---

Authors' Addresses 💌

The editors are J.D. Falk (editor) at Return Path, and M. Kucherawy (editor) at Cloudmark. Here are their details, verbatim:

J.D. Falk (editor)
Return Path
100 Mathilda Place, Suite 100
Sunnyvale, CA  94086
US

EMail: ietf@cybernothing.org
URI:   http://www.returnpath.net/


M. Kucherawy (editor)
Cloudmark
128 King St., 2nd Floor
San Francisco, CA  94107
US

EMail: msk@cloudmark.com