Subject: [ietf-dkim] Meaning of x= and DKIM signatures in general

From: John L <[email-masked]>
Date: Thu, 13 Apr 2006 01:24:48 -0400 (EDT)

The more I think about x=, the less I understand what it means.  I think 
what we have here is a fairly fundamental disconnect about the meaning of 
a DKIM signature.  These questions arose in the context of x= but they all 
remain an issue if you take out x= and replace it with "maximim message 
transit time".

My understanding of a DKIM signature is that it's the same idea as the 
clip at the end of a political ad where the candidate says "I'm Joe Blow 
and I approved this message".  The signature doesn't mean that the signer 
wrote the message or originated it, it just means that the signer approved 
it, and you can blame the signer if you don't like it.

There were two main reasons we decided to tell people to check DKIM 
signatures sooner rather than later after they're signed.  One is that 
signers aren't expected to keep verification keys available for a long 
time (unlike, say, S/MIME where signing keys have lifetimes measured in 
years if not decades), and we're using decent but not fabulous crypto so 
although we're reasonably confident that a bad guy can't crack a signature 
in a week, we're much less confident about what he can do in five years. 
The older a signature is, the less credible it is, but the credibility 
fades as it ages, it doesn't suddenly disappear.

But x= is like a candidate saying "I'm Joe Blow and I approved this 
message, but only if you're seeing it before next Wednesday."  Huh?  I can 
see how a message could become irrelevant (the election was on Tuesday, or 
an e-mail message has a bond price good for ten minutes), but that's not 
at all the same thing as saying you signed it then, but you unsigned it 
later.

So here's some scenarios.  You can assume that the x= value was a week 
after the signing time (or in the absence of x= the maximum transit time 
was a week), the verification key is still available, and there hasn't 
been a crypto crack that makes it trivial to spoof SHA-1 hashes.

A) I am a client of TiredMail, which does not support DKIM but does 
timestamp mail as it's dropped into my mailbox, typically a few minutes 
after the mail was sent.  So I use a spiffy MUA which can do DKIM checks 
as I pick up my mail.  I go on vacation for two weeks, and don't pick up 
my mail until I come back.  Is it OK to verify the mail using the time 
each message was put in my mailbox as the verification time?  If not, what 
bad things will happen if I do?

B) Your friend Fred runs the IT department for an organization that 
carefully archives all of its mail due to HIPPA, SEC, and SarbOx rules. 
Because he is a belt and suspenders kind of guy, he also archives the DKIM 
verification key records when they check the DKIM signatures as mail 
arrives.  Unfortunately, his programmer was the boss' incompetent nephew 
and a year later he found that all of the DKIM checks were screwed up, 
although the saved keys are OK.  Is it OK to recheck the signatures using 
the saved keys?  If not, what bad things will happen if he does?

B 1/2) If he hadn't saved the keys, would it be OK to recheck the 
signatures for which the keys are still available?  Again, if not, what 
bad things will happen if he does?

C) You duck out of the rain into a building which turns out to be a 
courthouse.  A trial is in progress in which a guy is accused of sending 
e-mail containing terroristic child pornography, but since the guy is not 
too swift, he sent it through his ISP which put on a DKIM signature and 
trace info pointing directly at the guy's PC.  The prosecutor brandishes a 
signed messaage and matching verification key. "You can't prove anything," 
says the guy's lawyer, "because this message was signed six months ago but 
its signature was only valid for a week."  The judge recognizes you as a 
DKIM expert (you were in the music video made to celebrate the release of 
the DKIM standard as RFC 5000) and has a bailiff escort you up to the 
witness stand and swear you in.  The judge asks you whether the DKIM 
signature and the trace information means that the message came from the 
guy's computer.  What do you say?

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Lyndon Nerenberg <[email-masked]>
Date: Wed, 12 Apr 2006 22:37:37 -0700

On Apr 12, 2006, at 10:24 PM, John L wrote:

> My understanding of a DKIM signature is that it's the same idea as  
> the clip at the end of a political ad where the candidate says "I'm  
> Joe Blow and I approved this message".  The signature doesn't mean  
> that the signer wrote the message or originated it, it just means  
> that the signer approved it, and you can blame the signer if you  
> don't like it.

Yes. Yes!  Just like when I sign a cheque dated April 1, 2006, my  
signature is good for that specific cheque written on that date.  You  
cannot apply that signature to any other cheque I might have written,  
on April 1 or on any other date.

And you can't guarantee that I might be alive at any future date to  
stand up in court and verify the signature.  The validity of the  
signature is from when I wrote the cheque until the recipient cashed  
it at the bank.  After that, it's too late ...

--lyndon

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 13 Apr 2006 11:12:29 +0100

John L wrote:
> e-mail containing terroristic child pornography, but since the guy is 
> not too swift, he sent it through his ISP which put on a DKIM signature 
> and trace info pointing directly at the guy's PC.  The prosecutor 
> brandishes a signed messaage and matching verification key. "You can't 
> prove anything," says the guy's lawyer, "because this message was signed 
> six months ago but its signature was only valid for a week."  The judge 
> recognizes you as a DKIM expert (you were in the music video made to 
> celebrate the release of the DKIM standard as RFC 5000) and has a 
> bailiff escort you up to the witness stand and swear you in.  The judge 
> asks you whether the DKIM signature and the trace information means that 
> the message came from the guy's computer.  What do you say?

You say that anyone could have added that signature, there being
no binding from the public key to the purported signer (i.e. no PKI,
which does exist for a reason) therefore DKIM stuff should be
weighed just exactly as much as an IP address in a logfile and no
more. If that doesn't work there are many other defensive avenues
to try, but "x=" is irrelevant here.

And all of that is of course absolutely not part of our charter so
let's not spend time figuring it out.

S.

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 13 Apr 2006 08:52:51 -0400

----- Original Message -----
From: "John L" <[email-masked]>

> The more I think about x=, the less I understand what it means.
> I think what we have here is a fairly fundamental disconnect about
> the meaning of a DKIM signature.  These questions arose in the
> context of x= but they all remain an issue if you take out x= and
> replace it with "maximim message transit time".

What's wrong with using the Message Reception Time? as proposed in:

http://mipassoc.org/pipermail/ietf-dkim/2006q2/003134.html

This addresses all time-shifted DKIM expiration scenarios.

Lets remember modern mail operations needs to work and be designed around
two fundamental platforms:

    o Dynamic, Online, Interactive,

    o Offline, Store and Forward, a Time-Shifted emulation
      of Interactive Operations.

The protocol for this expiration concept has to apply to both equally,
otherwise you can run into fuzzy inconsistent operations and sure enough,
new legal issues as well, as you duly pointed out.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

---

From: "John R Levine" <[email-masked]>
Date: 13 Apr 2006 10:27:08 -0400

> > courthouse. ...

> to try, but "x=" is irrelevant here.

My question is how does the age of the log entry or signature affect its
credibility and usefulness.  In the presence of x= or a fixed time limit,
how much more credible is the entry two seconds before the time limit ends
relative to two seconds after?

If the answer is "not very", that tells me that both x= and fixed time
limits are a mistake.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I shook hands with Senators Dole and Inouye," said Tom, disarmingly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 13 Apr 2006 15:38:54 +0100

> If the answer is "not very", that tells me that both x= and fixed time

That may well be true, but the credibility of a DKIM signature
in a court, or a year after signing, is explicitly not in scope
of this WG according to our charter.

Stephen.

---

From: John L <[email-masked]>
Date: Thu, 13 Apr 2006 10:49:00 -0400 (EDT)

> of this WG according to our charter.

I hope the credibility of a signature to a recipient is in scope, which is 
why I'm trying to figure out how x= or fixed time limits affect that 
credibility.

Regards,

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 13 Apr 2006 16:07:56 +0100

John L wrote:
> I hope the credibility of a signature to a recipient is in scope, which 
> is why I'm trying to figure out how x= or fixed time limits affect that 
> credibility.

I wouldn't call it credibility, but clearly the cryptographic
correctness of a signature that's just been received is in scope.
As is whether or not the signature satisfies whatever other rules
are specified in base. (And later we'll get to tackle the SSP-stuff
for signatures, but not seriously until base is done.)

With the current spec, I'd say that for values of t and x that have
been mentioned so far, maybe what happens at t+2*(x-t) is reasonable
to think about, but we can, and according to our charter, should,
entirely ignore what might or might not happen at t+100*(x-t).

The good reason to work this way is that the decade-later arguments
bring with them lots of stuff we just don't want to consider (e.g.
signed timestamps, archives of DNS RRs, what OS?. etc. etc.). But
there's the LTANS WG for people who like that kind of thing. There's
nothing wrong with thinking about those issues, but they're not
for this WG, with this charter.

Stephen.

PS: Sorry for jumping in on this one, but the topic is an enormous
rathole.

---

From: "John R Levine" <[email-masked]>
Date: 13 Apr 2006 11:45:59 -0400

> entirely ignore what might or might not happen at t+100*(x-t).

Entirely agree, and also agree that there's no way we're going to define
algorithms or bright line rules for this.

> PS: Sorry for jumping in on this one, but the topic is an enormous

No kidding.  So I hope we can ditch the rathole part and concentrate on
the large useful parts we understand.

Regards,

---

From: "william(at)elan.net" <[email-masked]>
Date: Thu, 13 Apr 2006 09:44:43 -0700 (PDT)

On Wed, 12 Apr 2006, Lyndon Nerenberg wrote:

>> My understanding of a DKIM signature is that it's the same idea as the clip 
>> at the end of a political ad where the candidate says "I'm Joe Blow and I 
>> approved this message".  The signature doesn't mean that the signer wrote 
>> the message or originated it, it just means that the signer approved it, 
>> and you can blame the signer if you don't like it.
>
> Yes. Yes!  Just like when I sign a cheque dated April 1, 2006, my signature 
> is good for that specific cheque written on that date.  You cannot apply that 
> signature to any other cheque I might have written, on April 1 or on any 
> other date.
?
> And you can't guarantee that I might be alive at any future date to stand up 
> in court and verify the signature.  The validity of the signature is from 
> when I wrote the cheque until the recipient cashed it at the bank.

Actually the validity of check is from when you wrote it until 60 days 
unless it has been checked in the bank sooner. In fact for some checks
the validity is even smaller then 60 days (it is usually written on the
check) while for others its longer.

---
William Leibzon
Elan Networks
[email-masked]

---

From: Michael Thomas <[email-masked]>
Date: Thu, 13 Apr 2006 09:53:28 -0700

Lyndon Nerenberg wrote:
> signature is from when I wrote the cheque until the recipient cashed  it 
> at the bank.  After that, it's too late ...

What a fortunate (or unfortunate, depending on your point of view)
analogy. Checks often explicitly have expiration dates on them. I
view the x= somewhat similarly -- after that date, please don't bother
me; done is done. This isn't rocket science.

		Mike