Subject: [ietf-dkim] signature h= and z= tags

From: "Hector Santos" <[email-masked]>
Date: Thu, 23 Feb 2006 01:01:04 -0500

I need clarification with the DKIM-Signature: tags:

    h=
    z=

1) Can z= include headers that are not listed in h= and vice versa?

For example, a signature has:

   h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version;

and

   z=From:aaaaaaaa|Subject:bbbbbbbb|To:ccccccccccccc;

the To: subject is included in z= but not listed in h=

2) If z= is defined, and h= has headers not listed in z=, but exist in the
822 headers, what do you do here for validating the hashing?

For example, Content-type:, Content-Transfer-Encoding:, and MIME-Version:
are in h= but not in z=  but the three headers do exist in the email
headers.

3) Why so complex?

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 24 Feb 2006 23:49:04 -0500

Any input regarding this?

Is the specs clear about this?

   z=   Copied header fields (plain-text, but see description; OPTIONAL,
       default is null).  A vertical-bar-separated list of header field
       names and copies of header field values that identify the header
       fields presented to the signing algorithm.  The field MUST
       contain the complete list of header fields in the order presented
       to the signing algorithm.  Copied header field values MUST
       immediately follow the header field name with a colon separator
       (no white space permitted).

       Verifiers MUST NOT use the copied header field values for
       verification should they be present in the h= field.  Copied
       header field values are for forensic use only.

The two paragraph seem to be in conflict.

Some messages here have exactly what I described below:

Based on this, what are the header values to be verified. If Z is for
"forsensic" only, then why is TO: listed when in fact, it is now part of h=?

When I first read this,  it seems Z headers match the H headers but contains
the values used for hashing.

---
Hector

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 25 Feb 2006 18:45:34 +0100

> Any input regarding this?

Okay, I can offer some rants and flames about the z= crap ;-)
Officially we're not yet at "base" details, there are still
several open "threats" tickets.

> OPTIONAL,

I'd go for SHOULD NOT and "deprecated" if possible, or maybe
a conditional MAY only for testing.

> Based on this, what are the header values to be verified.

The real header fields enumerated in h=.

> If Z is for "forsensic" only, then why is TO: listed when
> in fact, it is now part of h=?

You could still compare it with the real To header field, to
analyze weird mail modifications.  

The z= appears to be a bad idea, like SPF's exp= or "X-Face:"
header fields.  On the wrong side of the border to net abuse.
Maybe we could get away with reserving z= as "deprecated and
MUST be ignored" ?
                        Bye, Frank