Fighting Spam by Encapsulating Policy in Email Addresses.

Everyday network interactions require users to give out their email address, yet no guarantees can be made about how this address will be used. Sometimes the address is given to a human (e.g., on a business card), but many times it is entered in a web form as part of a web transaction. Unfortunately, that email address frequently finds itself in spammers' lists, never to be removed again. We propose the concept of the Single-Purpose Address (SPA); SPAs are generated by a program, and then cut-andpasted into the web page (or other application) requesting an email address. In its more general form an SPA encodes a security policy that describes the acceptable use of the address; since senders cannot be trusted to abide by it, this policy is enforced by the receiver, who generated the policy in the first place. SPAs are cryptographically protected to shield them from tampering. Since SPAs are not meant to be typed by humans, but rather processed by computer only, they do not have to be short, memorable, or even pronounceable. We present ways to construct such addresses, and we show the implementation of an optimized case.