Subject: [ietf-dkim] fyi- current open issues

From: Eliot Lear <[email-masked]>
Date: Thu, 09 Feb 2006 10:56:53 +0100

Attached is the current issues list and the opener.  Remember, to open
an issue, put "New Issue" in the header.  This list was generated from
rt.psg.com (the roundup stuff isn't yet cooked).

Eliot

*1170 <https://rt.psg.com/Ticket/Display.html?id=1170>* 	* Introduction
lacks the introduction of SSP
<https://rt.psg.com/Ticket/Display.html?id=1170>* 	new 	dkim 	Nobody 	0

	[email-masked] 	2 weeks ago 	
	2 weeks ago 	0
*1171 <https://rt.psg.com/Ticket/Display.html?id=1171>*
*draft-ietf-dkim-threats-00 Clarification of the DKIM mechanism
<https://rt.psg.com/Ticket/Display.html?id=1171>* 	new 	dkim 	Nobody 	0

	[email-masked] 	2 weeks ago 	
	2 weeks ago 	0
*1172 <https://rt.psg.com/Ticket/Display.html?id=1172>* 	*disagreement
on impact and probability of Attacks Against Message Signatures
<https://rt.psg.com/Ticket/Display.html?id=1172>* 	new 	dkim 	Nobody 	0

	[email-masked] 	2 weeks ago 	
	2 weeks ago 	0
*1173 <https://rt.psg.com/Ticket/Display.html?id=1173>* 	*Does Section
4.1.4 properly address traceability and accountability?
<https://rt.psg.com/Ticket/Display.html?id=1173>* 	new 	dkim 	Nobody 	0

	[email-masked] 	2 weeks ago 	
	2 weeks ago 	0
*1174 <https://rt.psg.com/Ticket/Display.html?id=1174>*
*raft-ietf-dkim-threats-00 Limited information in a critical section
<https://rt.psg.com/Ticket/Display.html?id=1174>* 	new 	dkim 	Nobody 	0

	[email-masked] 	2 weeks ago 	
	2 weeks ago 	0
*1180 <https://rt.psg.com/Ticket/Display.html?id=1180>*
*draft-ietf-dkim-threats-00 DKIM can be effective within the
Originator's AdmD <https://rt.psg.com/Ticket/Display.html?id=1180>*
open 	dkim 	Nobody 	0

	[email-masked] 	10 days ago 	
	10 days ago 	0
*1181 <https://rt.psg.com/Ticket/Display.html?id=1181>* 	*Misleading
figure in 1.1 <https://rt.psg.com/Ticket/Display.html?id=1181>* 	new
dkim 	Nobody 	0

	[email-masked] 	10 days ago 	
	10 days ago 	0
*1182 <https://rt.psg.com/Ticket/Display.html?id=1182>* 	*Eavesdropping
may permit man-in-the-middle as well
<https://rt.psg.com/Ticket/Display.html?id=1182>* 	new 	dkim 	Nobody 	0

	[email-masked] 	10 days ago 	
	10 days ago 	0
*1183 <https://rt.psg.com/Ticket/Display.html?id=1183>* 	*carryover:
draft-allman-dkim-base-01.txt - Should we have an r= tag in either the
signature or key record
<https://rt.psg.com/Ticket/Display.html?id=1183>* 	new 	dkim 	Nobody 	0

	[email-masked] 	10 days ago 	
	10 days ago 	0
*1184 <https://rt.psg.com/Ticket/Display.html?id=1184>* 	*carryover:
Develop plan for transition of multiple crypto algs (a=)
<https://rt.psg.com/Ticket/Display.html?id=1184>* 	new 	dkim 	Nobody 	0

	[email-masked] 	10 days ago 	
	10 days ago 	0
*1185 <https://rt.psg.com/Ticket/Display.html?id=1185>* 	*carryover:
draft-allman-dkim-base-01.txt Transition sha-1 to sha-256
<https://rt.psg.com/Ticket/Display.html?id=1185>* 	new 	dkim 	Nobody 	0

	[email-masked] 	10 days ago 	
	10 days ago 	0
*1186 <https://rt.psg.com/Ticket/Display.html?id=1186>* 	*4.2 needs new
Attack Item: Inconsistent Signature vs Policy Attacks
<https://rt.psg.com/Ticket/Display.html?id=1186>* 	new 	dkim 	Nobody 	0

	[email-masked] 	9 days ago 	
	9 days ago 	0

_______________________________________________
NOTE WELL: This list operates according to &lt;http://dkim.org/ietf-list-rules.html&gt;

---

From: Douglas Otis <[email-masked]>
Date: Thu, 9 Feb 2006 09:58:52 -0800

On Feb 9, 2006, at 1:56 AM, Eliot Lear wrote:

> Attached is the current issues list and the opener.  Remember, to  
> open an issue, put "New Issue" in the header.  This list was  
> generated from rt.psg.com (the roundup stuff isn't yet cooked).

The "Limited scope of trust issue", is perhaps too broad and has  
become too large.  The current threat draft makes a significant  
assumption that resolution of a replay attack will not be based upon  
the signing-domain.  This concern was the motivation for expanding  
upon this threat area.

This issue can be broken down into smaller sections (posted slowly).   
Many of these issues have been discussed previously, and prior to the  
forming of the DKIM WG.  It should be beneficial to arrive at some  
conclusion within the threat draft what the specific concerns are and  
what might be done to ameliorate them.  Trust issues fall into a  
broad category of threats that may prevent DKIM from serving as a  
basis for acceptance.  Reviewing in very general terms how bad acts  
are assessed, and then how further bad acts can be blocked seem  
rather basic concerns for any protocol.

I also noticed that clicking upon the links that you give require a  
sign-in.  Did I miss your explanation on how that works?  Also, what  
is the procedure for making updates?

-Doug

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 09 Feb 2006 21:40:42 +0100

Douglas Otis wrote:

> I also noticed that clicking upon the links that you give
> require a sign-in.  Did I miss your explanation on how that
> works?

User ietf password ietf used to work for me before they screwed
up their certificates in some non-netscape-SSL3-compatible way
For the root certificate see <http://rt.psg.com>

> Also, what is the procedure for making updates?

In theory you can add comments to existing tickets.  But in
practice I'd hate that because my "mozilla 3" cannot access it
anymore since summer 2005.

Besides we wouldn't need a mailing list if we'd start to use
the ticket system for discussions.  Some decent bugzilla or
Wiki without any backward-incompatible OpenSSL-magic would be
much more appropriate.  And what's wrong with a mailing list ?

The issue tracker is mainly a tool for the WG Chairs, let them
do their job, and let all others stick to the list, please.

                          Bye, Frank

---

From: Eliot Lear <[email-masked]>
Date: Sat, 11 Feb 2006 17:31:35 +0100

> is the procedure for making updates?
Username/password ietf/ietf.

Eliot
_______________________________________________
NOTE WELL: This list operates according to 
http://dkim.org/ietf-list-rules.html