Subject: [ietf-dkim] draft-ietf-dkim-threats-00 Misstatement of the DKIM mechanism

From: Douglas Otis <[email-masked]>
Date: Tue, 24 Jan 2006 13:51:15 -0800

---[A: Misstatement of the DKIM mechanism.]
,---
| 1.  Introduction
|
| DomainKeys Identified Mail (DKIM) [I-D.allman-dkim-base] defines a
| mechanism by which email messages can be cryptographically signed,
| permitting a signing domain to claim responsibility for the use of a
| given email address.
'---

A verified signature does not indicate that the signing domain is  
claiming responsibly for some email-address found within the  
message.  It is not a reasonable practice for a general access  
provider to inject a Sender header just to meet this expectation.   
This has already caused problems and should be avoided.

This should read:

: DomainKeys Identified Mail (DKIM) [I-D.allman-dkim-base] defines a
: mechanism by which email messages can be cryptographically signed,
: permitting a signing domain to be held accountable for the message.
: When an email-address contained within the message is also within
: the signing domain, and noted within the 'i' parameter, the signing
: domain may also be held accountable for verifying the use of the
: email-address conforms to their policies.

-Doug

_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Jan 2006 22:14:48 +0000

Douglas Otis wrote:
> claiming responsibly for some email-address found within the message.  
> It is not a reasonable practice for a general access provider to inject 
> a Sender header just to meet this expectation.  This has already caused 
> problems and should be avoided.
> 
> This should read:
> 
I've a few issues with that suggested text:

- "contained within" is too much - [email-masked] is "contained
within" this message but I guess that's not what you mean.

- I'm pretty sure we don't want to be talking about something
as concrete as the "'i' parameter" at this level since such
details are liable to change at inconvenient moments.

- The "may" in the last clause is also a bit ambiguous - do you
mean "can" or "might"?

(I also don't see how your comment connects the new and
old text but am happy to join the dots myself later:-)

Stephen.

---

From: Douglas Otis <[email-masked]>
Date: Tue, 24 Jan 2006 14:30:55 -0800

> old text but am happy to join the dots myself later:-)

Does this look better?

: DomainKeys Identified Mail (DKIM) [I-D.allman-dkim-base] defines a
: mechanism by which email messages can be cryptographically signed,
: permitting a signing domain to be held accountable for the message.
: When an email-address within a message header field is also within
: the signing domain, and specified by a signature parameter, the
: signing domain might also be held accountable for verifying that
: the use of the email-address conforms to their policies.

-Doug

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 24 Jan 2006 22:33:55 +0000

> : the use of the email-address conforms to their policies.

Looks much better to me, though I had no problem with the original.

(Now let's see if anyone dislikes the "specified by a signature
parameter" bit or not:-)

Stephen.

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 25 Jan 2006 15:52:49 +0100

Stephen Farrell wrote:
 
> Looks much better to me

+1

> though I had no problem with the original.

That was a bit vague, Doug's proposal is IMO clearer.  Bye