On the Security of a Certified E-Mail Scheme with Temporal Authentication

Certified e-mail is a value-added service for standard e-mail systems, in which the intended recipient gets the mail content if and only if the mail originator receives a non-repudiation evidence that the message has been received by the recipient. As far as security is concerned, fairness is one of the most important requirements. Recently, Galdi and Giordano (2004) presented an optimistic protocol for certified e-mail with temporal authentication. In this paper, we analyze their protocol and demonstrate that it cannot achieve true fairness and has some other weaknesses. We further propose the improvements to avoid those security problems.