Subject: [ietf-dkim] dkim-base-01: Section 6.2 Get the Public Key

From: "Hector Santos" <[email-masked]>
Date: Fri, 14 Apr 2006 09:18:14 -0400

Eric,

In regards to the expiration tag x=, until a decision is made about its
fate, it is still part of the specs.  In such a case, to comply with the x=
current specs,  a preliminary step is missing in section 6.2:

| 6.2  Get the Public Key
|
|  ...
|
+   0.  If signature has an expiration (x=) tag, check if the signature
+       has expired. Signatures MUST NOT be considered valid if the
+       current time at the verifier is past the expiration date.
+
|   1.  Retrieve the public key as described in (Section 3.6) using the
|       domain from the "d=" tag and the selector from the "s=" tag.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eliot Lear <[email-masked]>
Date: Fri, 14 Apr 2006 16:42:38 +0200

Hector,

I'd claim this is not a nit.

Eliot

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 14 Apr 2006 11:39:33 -0400

Thats why I left it as Step Zero. <g>

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 14 Apr 2006 08:47:49 -0700

>I'd claim this is not a nit.

+1

---

From: John Levine <[email-masked]>
Date: 14 Apr 2006 16:08:07 -0000

+1

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 14 Apr 2006 13:05:10 -0400

Eliot,

Just curious.

Since we now have the chieftain syndrome in play, anyone care to provide the
professional courtesy explaining why?

Seriously, I would like to understand what are nits and non-nits.

Besides the argument whether x= is required, useful, the sections goes into
detail to provide an itemized series of steps.  At what point or step does
one follow the x= functional specification?  According the specs, you don't
need to get the public key if there is expired signature. Call it an
optimizing step, I'm just wondering why Joe Average Developer will not see
the same thing.

Thanks

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 14 Apr 2006 10:43:05 -0700

>Seriously, I would like to understand what are nits and non-nits.

Correcting spelling and punctuation is a nit.

Changing a word or phrase to say the same thing but better is a nit.

Adding a new step that is required in the protocol is not a nit.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eric Allman <[email-masked]>
Date: Thu, 27 Apr 2006 14:26:03 -0700

Sorry to have gone dark for a while --- I've been even more than 
usually busy.  I'm trying to get a bit of catching up done today.

What I did for this was to add something to 6.1 reading "Verifiers 
MAY ignore the DKIM-Signature header field if it contains an "x=" tag 
and the signature has expired."  I then added to the end of 6.1 "If 
there are no valid signatures remaining after this step, a verifier 
MUST NOT proceed to the next step."

eric

--On April 14, 2006 9:18:14 AM -0400 Hector Santos 
<[email-masked]> wrote:

> Eric,
>
> In regards to the expiration tag x=, until a decision is made about
> its fate, it is still part of the specs.  In such a case, to comply
> with the x= current specs,  a preliminary step is missing in
> section 6.2:
>
>| 6.2  Get the Public Key
>|
>|  ...
>|
> +   0.  If signature has an expiration (x=) tag, check if the
> signature +       has expired. Signatures MUST NOT be considered
> valid if the +       current time at the verifier is past the
> expiration date. +
>|   1.  Retrieve the public key as described in (Section 3.6) using
>|   the domain from the "d=" tag and the selector from the "s=" tag.
>
> --

---

From: Dave Crocker <[email-masked]>
Date: Sat, 29 Apr 2006 12:11:04 -0700

Eric Allman wrote:
> What I did for this was to add something to 6.1 reading "Verifiers MAY 
> ignore the DKIM-Signature header field if it contains an "x=" tag and 
> the signature has expired."  I then added to the end of 6.1 "If there 
> are no valid signatures remaining after this step, a verifier MUST NOT 
> proceed to the next step."

If we are to keep the x= parameter, this change to the text strikes me 
as an extremely constructive navigation of the challenges to its use. 

and lest my wording be confusing:  +1.

d/

-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>