|
| 1 | +--- |
| 2 | +title: Authentication (email trust & anti-impersonation) |
| 3 | +sidebar_position: 1 |
| 4 | +--- |
| 5 | + |
| 6 | +:::note |
| 7 | +This page is based on an **older partner research PDF** and is provided as a conceptual use case. It describes “Timescribe” style flows that are **not shipped as a built-in Catalyst product** today. |
| 8 | +::: |
| 9 | + |
| 10 | +## Problem |
| 11 | + |
| 12 | +Email impersonation and phishing are effective because recipients cannot reliably verify the sender’s identity. Even when organizations adopt anti-malware tools, spoofing and Business Email Compromise can still succeed. |
| 13 | + |
| 14 | +## What Catalyst enables (conceptually) |
| 15 | + |
| 16 | +- **Verifiable signatures**: messages can carry a signature that recipients can verify against an organization identity key. |
| 17 | +- **Immutable audit trail**: a tamper-resistant record of “message fingerprints” can help prove timing and provenance. |
| 18 | +- **Automation**: identity proofs can be generated automatically by a mail gateway or client plugin. |
| 19 | + |
| 20 | +## A practical architecture |
| 21 | + |
| 22 | +1) **Organization identity** is established (KYC/verification outside the chain, then publish a public key + metadata). |
| 23 | +2) Outbound email is processed by: |
| 24 | + - a **mail gateway** (recommended), or |
| 25 | + - a **client plugin** |
| 26 | +3) The gateway: |
| 27 | + - hashes the email (or selected fields), |
| 28 | + - signs the hash with the org key, |
| 29 | + - optionally timestamps the signed hash on-chain. |
| 30 | +4) Recipients verify: |
| 31 | + - the signature matches the org key, |
| 32 | + - the timestamp/audit entry exists (optional). |
| 33 | + |
| 34 | +## What’s required (today) |
| 35 | + |
| 36 | +This use case requires application-layer work: |
| 37 | + |
| 38 | +- an email gateway/plugin |
| 39 | +- a registry of “known org keys” (could be on-chain via contracts, or off-chain with on-chain anchoring) |
| 40 | +- UX that makes “verified sender” obvious |
| 41 | + |
| 42 | +## Verify |
| 43 | + |
| 44 | +- Run a demo where a signed email is accepted and a forged email is flagged. |
| 45 | +- Store only **hashes** on-chain (never store email contents). |
| 46 | + |
| 47 | +## Links |
| 48 | + |
| 49 | +- **Catalyst website**: `https://catalystnet.org/` |
| 50 | +- **Docs**: `https://docs.catalystnet.org/` |
| 51 | + |
0 commit comments