Subject: RE: [ietf-dkim] Re: WG Review: Domain Keys Identified Mail (dkim)

From: "Patrick Peterson" <[email-masked]>
Date: Thu, 22 Dec 2005 13:38:41 -0800

***
cutting all text from about 30 messages on the subject
***

I'm on a plane now from Asia, finally catching up on the mailing list.
After reading the postings, I've never been more concerned about the
future of DKIM. Here's why:

The list is quiet for weeks and then a storm of emails on the charter
language. Are we really 30X more interested in charter language than in
the technology? I think so!

Disclaimer: my bias is toward moving DKIM forward on a reasonable,
expedient path. But I'm smart enough to know that while my analysis may
show a lack of critical flaws in the current specs, there may be some
hiding somewhere. But after reading the last 30 email messages, I can't
discrern any meaningful flaws that can be used to improve the technical
specifications. So, I have to agree with Dave's oft-asked question:
"what changes should be made to the technical specifications?" Right now
I can't figure this out. Perhaps they are critical, maybe not. But right
now I feel there is a tremendous amount of "concerns" and "don't do it
*this* way" and a lack of "section X states blah. this is bad because of
XYZ. change it to improved blah." this is the type of discussion I feel
would benefit us tremendously, even if it leads to upsetting the apple
cart. while i don't personally see the needs for radical changes to
current DKIM specs, i'm open to them if someone can present clear data
and recommended changes. if DNS is the wrong place for DKIM records or
if Doug's weekly-proposed recognition scheme is the second coming of the
IETF deity himself, great. somebody just present some hard issues and
solutions!

Let's hammer out the technical specifications, make them the best they
can be and get this thing to market. Let's not discuss whether the
charter should allow divergence from DNS, let's discuss the best
solution and if DNS can be proven the wrong way to go, I'll gladly argue
for this change. Let's be technologists, not philosophers.

Two other comments:
1. In talking to a few hundred Japanese and Chinese IT folks last week,
I tried to explain the promise and (many) limitations of DKIM and SIDF.
Internet users are counting on us to add authentication of some type to
SMTP. I would never support a fundamentally flawed or unworkable
technology, but I fear that if DKIM standardization does not move
forward with some positive actions in the next few months with tangible
results in the next year, the technology deployers may lose interest and
our wonderful specification may go unadopted, solving no problem. (I
*do* support imperfect technologies all the time. I consider DKIM
imperfect but not flawed or unworkable. But I look forward to specific
examples of this together with solid solutions ready for inclusion in
the specification.)

2. On adoption: I'm happy to hear of Arvel's success in propagating
DKIM. Even the longest journey begins with a first step. I wish I could
say the same for our customers. Unfortunately they are very actively
deploying DK technology. They aren't interested in signing with DKIM if
few are validating DKIM and they perceive too much in limbo concerning
DKIM. They are looking forward to the consensus that gives them
confidence in DKIM to switch from DK. Until then, they will stay with
the legacy de facto standard. Brilliant or stupid, this is the market
speaking, if I could get them to all do my bidding, I'd be a very rich
man. :)

pat

_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: "Arvel Hathcock" <[email-masked]>
Date: Thu, 22 Dec 2005 16:10:21 -0600

> 2. On adoption: I'm happy to hear of Arvel's success
> in propagating DKIM. Even the longest journey begins
> with a first step. I wish I could say the same for our
> customers. Unfortunately they are very actively deploying
> DK technology.

Ours too.

> They aren't interested in signing with DKIM if few are
> validating DKIM and they perceive too much in limbo
> concerning DKIM.

That's certainly true too.   This can change once the first big ISP starts 
using DKIM.  But that won't happen until the IETF process stabalizes and 
real work starts being turned out (this is just my view).

-- 
Arvel

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 22 Dec 2005 15:50:05 -0800

> for this change. Let's be technologists, not philosophers.

But the problem is that the currently proposed charter, would, IMO,
preclude the adoption of something that was a better way to go if it
couldn't be demonstrated that that change was necessary for the success
of DKIM. That's why discussing that charter language is prior
the discussion of specific technical changes.

-Ekr

---

From: Dave Crocker <[email-masked]>
Date: Thu, 22 Dec 2005 16:24:42 -0800

> the discussion of specific technical changes.

That's the nice thing about objections without investment.

They are so purely conceptual and, therefore are not burdened by any 
obligation to provide substance.  Not even the minor effort of examples.

In that light, it's not surprising that you failed to gain support 
during the open DKIm BOF and online group discussions.

But never mind, you've got folks hassled enough they are going to give 
in just to get the working group chartered.  Boy oh boy does this bode 
well for the working group, or what?

d/

-- 

  Dave Crocker
  Brandenburg InternetWorking
  +1.408.246.8253
  dcrocker  a t ...
  WE'VE MOVED to:  www.bbiw.net
_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 22 Dec 2005 16:39:03 -0800

> during the open DKIm BOF and online group discussions.

Well, Dave, I didn't raise this issue at all in Vancouver, and I saw
support for it in Paris. As for the mailing list, I assume you're
familiar with the word "self-selected".

In any case, a number of people on the IETF list seem to agree with me.
And since the standard is IETF consensus...

-Ekr

---

From: Mark Delany <[email-masked]>
Date: Fri, 23 Dec 2005 00:50:40 +0000

> the discussion of specific technical changes.

Patrick said "wrong". Eric said "better". I believe this is the crux
of the issue.

The DKIM proponents are saying they want something close to the
current spec as they think it will work, they think it solves their
need and they think they can deploy it. I think it's fair to say that
most of the DKIM proponents have not come to this conclusion lightly.

The not-DKIM proponents want something better, for some value of
"better". What the not-DKIM proponents have failed to do is identify
who wants their "better" or who will deploy their "better". In other
words, why is it really "better"? Apart from esoterics of course.

Three approaches to challenging the DKIM proponents are to a) question
their competence b) question their diligence in arriving at their
proposal c) convince them that "better" will improve their
market-share.

If I can be presumptuous Eric, I believe you're targeting c). If so,
can you elaborate?

Mark.

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 22 Dec 2005 17:33:23 -0800

Mark Delany <[email-masked]> wrote:

> Patrick said "wrong".

I would note that Patrick also said "best".

> Eric said "better". I believe this is the crux
> of the issue.

Yes, I agree.

> most of the DKIM proponents have not come to this conclusion lightly.

The relevant issue here isn't "close to the current spec"
but rather "backward compatible with the current spec", which
isn't the same thing at all. 

> "better".

More accurately, we want the charter not to foreclose the option
of doing something better, on the grounds that it's incompatible.

> What the not-DKIM proponents have failed to do is identify

Well, speaking only for myself, the reason that I haven't done so is that
that that's not the discussion we're having right now. We're still
discussing the ground rules. And the reason we're having that discussion
is that the DKIM proponents want a charter that essentially precludes
making incompatible changes. Once that issue is settled, I'll
be happy to have a technical discussion about what would or
would not be better.

-Ekr

---

From: Douglas Otis <[email-masked]>
Date: Thu, 22 Dec 2005 18:03:47 -0800

On Dec 22, 2005, at 4:50 PM, Mark Delany wrote:
> need and they think they can deploy it. I think it's fair to say  
> that most of the DKIM proponents have not come to this conclusion  
> lightly.
>
> "better". What the not-DKIM proponents have failed to do is  
> identify who wants their "better" or who will deploy their  
> "better". In other words, why is it really "better"? Apart from  
> esoterics of course.
>
> Three approaches to challenging the DKIM proponents are to
>   a) question their competence
>   b) question their diligence in arriving at their proposal
>   c) convince them that "better" will improve their market-share.
>

Adoption will suffer due to inordinate lookup requirements at the  
receiving MTA.  Every message must perform multiple lookups to  
discover closed-policies found for a fractional percentage of the  
email-domains.  Relief from abuse requires reputation services.  For  
reputation services, solutions for abusive message replay must be  
found.  The current draft also lacks solutions in this area as well.   
The only discernible strategy seems to shift accountability onto the  
often hapless email-address domain owner, rather than the DKIM  
signer.  Note who should receive the complaints.

Being in favor of DKIM as a means to enhance the SMTP transport does  
not extend to the SSP draft where many at the last BOF suggested this  
mechanism had several problems.  Adopting a recognition strategy  
offers a reasonable solution and there are other possible solutions.   
The clearly broken solution is the SSP draft however.

Issues related to the use of a CERT RR would be examples of  
engineering that may depreciate some of the existing  
implementations.  Changes in hash functions, signature options,  
defined roles, or limiting the number of signatures are areas where  
changes must occur with little guidance from the existing drafts.

I assume you meant adoption, but perhaps I should ask what market- 
share means to you?

-Doug

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 23 Dec 2005 13:33:43 +0000

Hi Eric,

> of doing something better, on the grounds that it's incompatible.

I hope Tony's proposal to use the xmpp text instead resloves the
charter issue for you.

I think if we have a consensus on that text amongst both proponents
and not-proponents then we can and should move on. (Which for this
list means considering Jim's latest threats draft I guess.)

My reading of the situation is that we do seem to have such a
consensus, albeit with a couple of clear dissenters, but of
course in this instance its the IESG's reading of the situation
that matters.

Stephen.

---

From: "william(at)elan.net" <[email-masked]>
Date: Fri, 23 Dec 2005 07:55:50 -0800 (PST)

> list means considering Jim's latest threats draft I guess.)

Stephen,

The issue with limitations due to text that says that authorization
keys will be placed and retrieved from dns is still open.

---
William Leibzon
Elan Networks
[email-masked]