Subject: [ietf-dkim] issue with DKIM simple header algorithm and milter-based implementations

From: Tony Hansen <[email-masked]>
Date: Tue, 21 Feb 2006 10:58:39 -0500

I've been told that when faced with headers that have extra WSP (more
than one space or tab) between the : and the value, milter-based
implementations have a problem properly signing or verifying messages
with the simple header algorithm. The milter code itself strips out the
extra WSP *before* the siging/verifying code sees the header name and
value. At least one milter-based implementation handles this by making
the assumption that the headers always have a single space after the :.
Consequently, these implementations will fail when faced with such messages.

For those who know milter well, is my summary here correct?

Since milter-based solutions will probably be fairly commonly used, I
think we have a serious problem.

Some possible solutions include: writing off milter (nah, just kidding),
ignoring the problem (not a good idea), and possibly changing the
definition of simple (gulp).

If we were to change the definition of simple, the simplest change would
be to do as the milter-based code mentioned above does and just always
use a single space after the :.

I also have no idea how milter handles 822 headers with WSP *before* the
:. This may be a separate issue that we need to address as well.

	Tony Hansen
	[email-masked]
_______________________________________________
NOTE WELL: This list operates according to 
http://dkim.org/ietf-list-rules.html

---

From: Michael Thomas <[email-masked]>
Date: Tue, 21 Feb 2006 08:24:01 -0800

> Consequently, these implementations will fail when faced with such messages.

Tony --

This is what I get for being in a rush before a holiday. The actual
problem I found quite a while ago is that -- if I remember correctly --
the space between the header: and the value was either deleted or
changed to space. Specifically, foo:\tbar with simple would fail. I
just checked again with 8.13 and it seems to be giving it what it
actually saw in the smtp conversation, so maybe there's a version
difference here?

In any case, this is -- if still a problem at all -- milter related,
not spec related.

		Mike

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 21 Feb 2006 22:01:56 +0100

Michael Thomas wrote:

> In any case, this is -- if still a problem at all -- milter
> related, not spec related.

Some (most ?) news servers behave similarly for posted articles
and critical news header fields, they enforce an SP after the
colon by whatever it takes:  Reject or expand / replace HT.

All USEFOR drafts stick to this "magic SP" in news, MUSTard,
ABNF, and rough consensus.  It would be really nice if DKIM
ignores *WSP immediately following the colon,  I want DKIM to
work also in NetNews.
                         Bye, Frank

---

From: Michael Thomas <[email-masked]>
Date: Wed, 22 Feb 2006 09:20:41 -0800

> ignores *WSP immediately following the colon,  I want DKIM to

Note that the issue here is *only* for simple/header canonicalization:
relaxed works just fine. If netnews really enforces the "space after :"
then it would actually work just fine too.

Of course there isn't a milter interface for inn -- or is there,
Frank? :)

		Mike
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 22 Feb 2006 20:03:49 +0100

Michael Thomas wrote:

> Of course there isn't a milter interface for inn -- or is
> there, Frank? :)

Probably not, but it has something called "Pgpverify", maybe
DKIM could help to solve some news problems.  And there are
mail2news / news2mail gateways.  Supporting the "magic SP" 
in the mail2news direction.
                              Bye, Frank