Subject: RE: [ietf-dkim] one more comment I forgot...

From: <[email-masked]>
Date: Wed, 11 Jan 2006 11:35:11 -0500

If a forwarder "didn't" strip a signature from the message, after
decoding the hash and comparing to the information of the forwarding MTA
it wouldn't match anyway, would still invoke some rule on the receiving
entity would it not?

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Stephen Farrell
Sent: Wednesday, January 11, 2006 10:52 AM
To: [email-masked]
Subject: [ietf-dkim] one more comment I forgot...

...or rather hadn't thought of.

This could be added as "middling" comment #6:

Signature deletion. A mail forwarder might accidentally or
deliberately strip the signature from a message. If the
recipient has previously seen signed messages from that origin,
then strange behaviour might ensue. Similarly if the recipient
is using some policy support like SSP then it might treat the
mail less kindly and in a way that'd maybe be hard to figure out.

I don't know if this could be a real problem or not (would
lean towards "not" I guess) but I suppose its worth thinking
about, even if only to give us one "low/low" entry in one of
the tables:-)

Stephen.

_______________________________________________
ietf-dkim mailing list
http://dkim.org

_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 Jan 2006 16:54:24 +0000

Yes, but mucking up a signature is already covered in the
draft whereas totally ditching one isn't.

(Perhaps "forwarder" wasn't the right term - if not, mea
culpa.)

S.

---

From: Michael Thomas <[email-masked]>
Date: Wed, 11 Jan 2006 11:19:25 -0800

> (Perhaps "forwarder" wasn't the right term - if not, mea

 From a threat perspective, the two are identical, right? If a
receiver in any way treats broken signatures different than
missing signatures, an attacker can exploit the preferable
treatment trivially.

       Mike

---

From: Douglas Otis <[email-masked]>
Date: Wed, 11 Jan 2006 15:29:24 -0800

On Jan 11, 2006, at 11:19 AM, Michael Thomas wrote:

> Stephen Farrell wrote:
>>
>> Yes, but mucking up a signature is already covered in the draft  
>> whereas totally ditching one isn't.
>>
>> (Perhaps "forwarder" wasn't the right term - if not, mea culpa.)
>
> From a threat perspective, the two are identical, right?

The term mediator may have been better.  Removal of a signature  
within that role may also introduce a new signature by the mediator.   
In this case, a signature has been removed and replaced with a  
different signature.  In the case of replacement, the results should  
not be identical.  Being able to define the role of the signer may  
help resolve handling issues.

> If a receiver in any way treats broken signatures different than  

This was not about a broken signature, but a deliberately removed  
signature.  Once there is a greater concern related to the overhead  
associated with handling multiple signatures, how this gets handled  
will have greater importance.  A bad actor could trivially increase  
recipient burdens by introducing multiple signatures with various  
body lengths and multiple From addresses.  Unfortunately, due to the  
authorization scheme, this may also become a common practice by  
legitimate mediators. : (

-Doug

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 12 Jan 2006 13:33:55 +0000

> missing signatures, an attacker can exploit the preferable

Hmm...I guess so. Though the base-01 currently says (end of
page 30) "Separate policies MAY be defined for unsigned
messages, messages with incorrect signatures, and when the
signature cannot be verified."

Signature deletion is worth maybe a quick mention in threats
but no more I'd say, unless someone figures out some scenario
where this has more impact.

S.

---

From: Jim Fenton <[email-masked]>
Date: Thu, 12 Jan 2006 13:51:25 -0800

> signature cannot be verified."

That sounds like a good discussion when we get back to the -base draft.

I'm convinced that the verifier needs to treat broken signatures as if
they weren't there:

- If broken signatures are seen as better than the lack of a signature,
it's trivial to make one up.

- If broken signatures are seen as worse than the lack of a signature,
it will serve as a disincentive to signing messages:  potential signers
might not want to do so if they risk having their messages downgraded if
they pass through an MTA that breaks the signature (or through a mailing
list that does so).

> where this has more impact.

Agreed.  Will do.

-Jim

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 13 Jan 2006 13:34:24 +0000

> they pass through an MTA that breaks the signature (or through a mailing

Nicely put.

Stephen.

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 14 Jan 2006 04:49:21 +0100

>> - If broken signatures are seen as worse than the lack of a
>> signature, it will serve as a disincentive to signing
>> messages:  potential signers might not want to do so if they
>> risk having their messages downgraded if they pass through
>> an MTA that breaks the signature (or through a mailing list
>> that does so).

> Nicely put.

That's IMO the usual "you can't have your cake and eat it too".

A sender promising that all his mails are signed is OBVIOUSLY
talking about _valid_ signatures, and seriously wants that all
mails with no or invalid signatures are downgraded to /dev/null.

That's the one and only point of his signing policy.  Almost
exactly the same situation as SPF FAIL:  reject, reject, reject.

If he doesn't want that effect he should not publish a "closed"
signing policy.
                               Bye, Frank