|
Forensics
message-id formatting Mar 16 2007 06:14AM gdardick dardick net (2 replies) Re: message-id formatting Mar 19 2007 08:52PM Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (1 replies) Re: message-id formatting Mar 27 2007 06:50PM Simson Garfinkel (simsong acm org) (1 replies) Re: message-id formatting Mar 27 2007 07:01PM Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (2 replies) RE: message-id formatting Mar 29 2007 03:48PM Navroz Shariff (nshariff americanbible org) (1 replies) |
|
Privacy Statement |
> On Mar 27, 2007, at 12:01 PM, Ansgar -59cobalt- Wiechers wrote:
>> On 2007-03-27 Simson Garfinkel wrote:
>>> On Mar 19, 2007, at 1:52 PM, Ansgar -59cobalt- Wiechers wrote:
>>>> On 2007-03-16 gdardick (at) dardick (dot) net [email concealed] wrote:
>>>>> I am trying to find the format of mac.com message-ids. The
>>>>> following are examples of message-id's received in emails from
>>>>> mac.com.
>>>>>
>>>>> F39DF6D4-4C64-4C78-91E1-EB9EF83F492A (at) MAC (dot) COM [email concealed]
>>>>> 11DF7440-1BAC-4E05-9A6D-5F13C3DA7A53 (at) MAC (dot) COM [email concealed]
>>>>>
>>>>> Any ideas?
>>>>
>>>> I'm not sure if I understand your question correctly. Are you
>>>> looking for a regular expression to match those message-IDs?
>>>>
>>>> [0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}@MAC\.COM
>>>
>>> No. He's looking for a meaning of what they mean.
>>
>> Well, they're message-IDs, they don't mean anything by themselves.
>> They're just supposed to be unique identifiers for a given message
>> (e-mail, in particular).
>
> Actually, message-id's frequently have internal meaning, depending on
> where they are issued.
Maybe, but in that case the OP should have specified the context. Also
this interpretation doesn't explain why he said that he was trying to
"find the format" of these message-IDs.
> If Apple just wanted a random 128-bit number, they wouldn't put the
> dashes in it. There is internal structure --- a 32-bit number, three
> 16-bit numbers, and a 48-bit number. We just don't know what those
> numbers mean.
Another poster mentioned off-list that the left part might be a UUID, so
Apple may just have used a default method to create unique identifiers.
Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq
[ reply ]