Subject: Re: [ietf-dkim] Core algorithm support/use, draft text v2

From: Jim Fenton <[email-masked]>
Date: Wed, 01 Mar 2006 11:05:33 -0800

Mark Delany wrote:
> On Tue, Feb 28, 2006 at 11:06:35AM -0800, Jim Fenton allegedly wrote:
>
>   
>> I don't recall anyone suggesting that we require signers to do multiple
>> signatures (at least, I wasn't suggesting that).  In any case, I agree
>> with your statement.
>>     
>
> But surely at some point, if not at the beginning, they will have to,
> won't they?
>   
I guess I wasn't clear.  What I meant was that the specification
shouldn't require senders to apply two signatures (i.e., doesn't say
"MUST sign using both SHA-256 and SHA-1 hashes").  It needs to require
one, permit two, and I expect the desire for verification to succeed
will dictate when two signatures are required.
> Say, eg, SHA-4096 comes along and is ordained as the preferred hash in
> some future DKIM. A signer adopting SHA-4096, will need to continue to
> additionally sign with the older hashes as long as they believe some
> recipients may not have upgraded to verify SHA-4096.
>
> That comes back to the point that Ned et al made perhaps a week ago,
> if we know that transition will occur at some point in the future,
> leaving that code unexercised until then is surely a recipe for
> disaster.
>   
I think we're currently in a situation where two signatures might be
required in some contexts.  I don't have a problem with saying that
signers MUST be capable of generating multiple signatures, but I'm not
convinced that saying so will cause code to actually get exercised.

-Jim
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Mark Delany <[email-masked]>
Date: Wed, 1 Mar 2006 19:48:19 +0000

> will dictate when two signatures are required.

Ok. Sounds good.

> convinced that saying so will cause code to actually get exercised.

I think your first words were better. Signers may, verifiers MUST be
able to choose amongst multiple signatures consistent with local
policy (pick strongest, pick weakest, ignore unrecognized, whatever).

Mark.

---

From: Arvel Hathcock <[email-masked]>
Date: Thu, 02 Mar 2006 17:59:58 -0600

> leaving that code unexercised until then is surely a recipe for

Whenever anyone is ready, send a message to [email-masked] with both 
signatures and you should get an auto-response containing an 
Authentication-Results header at the top with some detail about each 
signature verification.  I can also flip a switch here and start signing 
with both sha1 and sha256 to test your verifier when you're ready.

-- 
Arvel

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 03 Mar 2006 01:17:42 +0000

Arvel,

> with both sha1 and sha256 to test your verifier when you're ready.

Have to say that that's the best response I've seen to all the debate!

Stephen.

---

From: Tony Hansen <[email-masked]>
Date: Fri, 03 Mar 2006 10:24:43 -0500

I just sent you 40 torture test messages signed with sha256. They all
passed.

Arvel, I'm ready when you are to see if I can verify any sha256 messages
your reflector sends back.

	Tony Hansen
	[email-masked]

Stephen Farrell wrote:
>> Whenever anyone is ready, send a message to [email-masked] with
>> both signatures and you should get an auto-response containing an
>> signature verification.  I can also flip a switch here and start
>> signing with both sha1 and sha256 to test your verifier when you're
>> ready.
>

---

From: Arvel Hathcock <[email-masked]>
Date: Mon, 06 Mar 2006 08:19:19 -0600

> Arvel, I'm ready when you are to see if I can verify any sha256
 > messages your reflector sends back.

Sorry for the delay, it's ready, go for it.  We can discuss the results 
off list so as not to bore everybody.

-- 
Arvel

---

From: Tony Hansen <[email-masked]>
Date: Tue, 07 Mar 2006 22:39:46 -0500

I threw almost 60 messages at your reflector. All of them verified just
fine for both the sha256 and sha1 signatures you're producing.

And for all of the test messages I threw at your reflector, your code
verified my sha256 signatures just as well as it verifies my sha1
signatures.

So, we now have two independent implementations of sha256 support, both
directions. Who's next?

	Tony Hansen
	[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 08 Mar 2006 07:41:13 +0000

Excellent.

S.

---

From: Michael Thomas <[email-masked]>
Date: Wed, 08 Mar 2006 06:04:34 -0800

> So, we now have two independent implementations of sha256 support, both

I've checked out my code using sha256 and it worked against
Arvel's reflector, though nothing extensive. I'm not ready
to upgrade to openssl 0.98a, so this was just a test.

		Mike