Subject: [Fwd: EKR - Re: [ietf-dkim] Review of draft-ietf-dkim-base-00 (1)]

From: Dave Crocker <[email-masked]>
Date: Mon, 20 Mar 2006 10:44:35 -0600

(sorry. firefox does not have a redistribute command. /d)

-------- Original Message --------
Subject: Re: [ietf-dkim] Review of draft-ietf-dkim-base-00 (1)
Date: Mon, 20 Mar 2006 06:04:58 -0800
From: Eric Rescorla <[email-masked]>
Reply-To: EKR <[email-masked]>
To: [email-masked]
CC: [email-masked]
References: <[email-masked]> 
<[email-masked]>

[Re-sent after a unicast addressing error....]

Dave Crocker <[email-masked]> writes:

>> S 1.1.
>>    o  there is no dependency on public and private key pairs being
>>       issued by well-known, trusted certificate authorities,
>> This claims seems somewhat disingenuous.
>
> It shouldn't. The statement is simply and directly accurate, as given.
>
> The problem with the analysis you provided is that it conflates a dependency
> that DKIM *does* have on the DNS, with the means that DNS might/will use to
> provide acceptable service.
>
> To pursue the line of concern you have raised, here are some simple questions:
>
> 1. Does DKIM specify anything that looks like a cert authority?
>
>     Answer:  No.
>
> 2. Does DKIM require validity of the data produced by the DNS?
>
>     Answer:  Yes.
>
> 3. Does the DNS provide reasonably good data validity today?
>
>     Answer:  Yes
>
> 4. Is the current DNS vulnerable?
>
>     Answer: Yes
>
> 5. Are CA's required to fix this?
>
>     Answer:  Maybe, but maybe not.  Certainly that is the path being explored,
>     planned on, and maybe even slightly deployed.  Other schemes might have been
>     feasible, but they aren't what has been defined.
>
> In other words, Eric,  the logic that goes from DKIM to a CA is rather
> circuitous.  It contains some twists and choices.

Uh, sure, if you say so. The fact is that the document explicitly
suggests that it be secured via DNSSEC, so the path is nowhere
near as indirect as you suggest.

> In fact if you are looking for the characteristic of craftiness that
> is implied by the word disingenuous, then I'd be inclined to suggest
> that it applies more to claiming that DKIM *does* use CAs than to
> the claim that it does not.

Of course you would.

-Ekr

-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html