A Review of Anti-Phishing Email Control Measures: Why we Need a Novel Digital Signature Scheme

Phishing, particularly spear phishing, remains a persistent and growing threat despite substantial efforts by industry and academia to combat it. Spear phishing attacks are especially dangerous as attackers impersonate known or trusted senders, deceiving recipients into believing the emails are legitimate. While various anti-phishing strategies have been developed, there is no definitive solution currently in sight. The crux lies in verifying the authenticity of email senders. Although digital signatures provide a robust mechanism for ensuring authenticity, they are often overlooked due to their complexity and cost. In this paper, we review current approaches to combating phishing and spear phishing emails and identify gaps that hinder guaranteeing authenticity. To address these gaps, we propose a novel digital signature scheme, shifting digital signatures from a user-oriented to a document-oriented model. Our approach automates the application of digital signatures using randomly generated sessional public-private key pairs for outgoing emails, offering a transparent and seamless solution. This staged implementation allows for gradual adoption across email systems, ultimately aiming to eliminate spear phishing attacks.