Subject: [ietf-dkim] Trust Annotation Support

From: Douglas Otis <[email-masked]>
Date: Tue, 25 Apr 2006 08:51:44 -0700

Trust annotation could highlight a message or place it into a special  
folder, for example.

Not all sources within a domain are equally vetted.

Increased use of sub-domains may weaken DKIM as a trust mechanism;  
which domain name should be trusted?

Well vetted sources can be indicated by the signer with some type of  
notation or semaphore.

Signer trust semaphores should be coupled with the signature.

Not all sources will be uniquely identified by an email-address, and  
not all recipients can reliably recognize an email-address.

Excluding poorly vetted sources from trust semaphores permits those  
better vetted sources to retain a level of trust.

DKIM may already implement source based key selection to support the  
key g= construct.

A label convention leverages key selection mechanisms and overcomes  
problems related to binding a specific generic header to a signature.

This label convention could apply to either the right-most or left- 
most label of the s= selector.

Example label conventions:
   _t-trn   Transactional*
   _t-adm   Administrative*
   _t-usr   Domain User
   _t-gst   Domain Guest
   _t-mdn   Mailer-Daemon
   _t-sys   System*

*Trustworthy sources (by convention).

Establishing this convention from the outset allows better security  
to be maintained.

-Doug

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jeff Macdonald <[email-masked]>
Date: Tue, 25 Apr 2006 15:04:05 -0400

> which domain name should be trusted?

So given this as a parent domain:

example.com

and these as subdomains of the parent domain:

transactional
admin
system
bulk

which one should be trusted? I'd say none.

> Signer trust semaphores should be coupled with the signature.

<snip the rest>

I do like this semaphore/opaque token idea. I think it answers Laura
Mathers' question (at the sender authentication summit) about MUA's
showing only quoted parts.

-- 
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | [email-masked]
:: 131 Hartwell Ave. | Lexington, MA 02421 
:: v: 781-372-1922 | f: 781-863-8118 
:: www.e-dialog.com

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 26 Apr 2006 12:32:14 -0700

> Well vetted sources can be indicated by the signer with some type of  

So, the signer -- who is most often the sender -- indicates to the 
receiver whether or not the message is trustworthy?

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Communications Platform Team
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Wed, 26 Apr 2006 14:59:50 -0700

On Apr 26, 2006, at 12:32 PM, J.D. Falk wrote:

>> Well vetted sources can be indicated by the signer with some type  
>> of  notation or semaphore.
>

This is making these assumptions.

1) A list of well-known and trustworthy domains can be compiled and  
freely distributed.

2) Few well-known domains are comprised exclusively of only well  
vetted sources.

3) A recipient can not reliably recognize email-addresses.

4) Trust is not easily managed at the email-address.

Assume MUA clients offers an ability to annotate messages based upon  
the DKIM signature.  A signed message from a major service provider  
will not offer much in the way of trust.  Millions of poorly vetted  
users will have their messages signed by this well known domain.  The  
same problem exists to a less degree when temporary workers obtain  
email-addresses within well known institutions.   When both halves  
the the email-address (right and left) are internationalized, the  
recipient will also be unable to recognize the email-address due to  
extensive character repertoires available allowing many many look- 
alikes.

Keep the list of well-known domains manageable.  Such a list should  
comprise the majority of critical transactional messages a recipient  
would normally see.  Without a means to differentiate internal  
sources, this list of well-known domains will become significantly  
diffused (expanded) when either hyphenated or  sub-domain names are  
utilized to differentiate the source being trusted.  When splitting  
the domain, the domain-name a provider may wish to have trusted would  
in fact not be well-known.  This bifurcation of domains, for purposes  
of re-establishing trust, will dilute brand recognition, confuse  
consumers, and play into the hands of phishers.  For example,  a  
provider "bigisp.com" might send administrative messages from either  
"bigisp-inc.com" or "admin.bigisp.com".  Their customers should be  
wary accepting these alternative, less known domains as more  
trustworthy.

Being able to differentiate better vetted sources _within_ the well- 
known domain restores a level of trust when messages are both signed  
by the well-known domain, and also marked as restricted (either  
transactional or administrative).  This assumes the well-known domain  
protects this trust by limiting access to these special keys (denoted  
by special selectors).  The well known service provider or  
institution could have their administrative or transactional messages  
obtain a trust annotation, without fearing one of their millions of  
customers or less trustworthy employees will spoof other customers by  
sending a hazardous message asking to apply a browser plug-in, for  
example.

-Doug

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 26 Apr 2006 19:04:04 -0400

> 1) A list of well-known and trustworthy domains can be compiled and
This would be a reputation system then and out of scope for the current 
effort.

Scott K

---

From: Michael Thomas <[email-masked]>
Date: Wed, 26 Apr 2006 16:05:31 -0700

> sending a hazardous message asking to apply a browser plug-in, for  

Why would this need standardization? All a domain needs to do is decide for
itself which selector subdomains to organize the different kinds of 
traffic it
views as, well, different, and reputation systems ought to be able to 
figure this
out for themselves. Indeed, they MUST be able to independently establish
that.

       Mike

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 26 Apr 2006 17:30:24 -0700

> out for themselves. Indeed, they MUST be able to independently establish

I agree -- and we're already starting to do that with DK selectors 
today.  While a best practice around what to name your selectors may 
make sense at some point in the future, it's way too early for that now.

---

From: Douglas Otis <[email-masked]>
Date: Wed, 26 Apr 2006 17:40:11 -0700

On Apr 26, 2006, at 4:05 PM, Michael Thomas wrote:

> Douglas Otis wrote:
>
>> Being able to differentiate better vetted sources _within_ the  
>> well- known domain restores a level of trust when messages are  
>> both signed  by the well-known domain, and also marked as  
>> restricted (either  transactional or administrative).  This  
>> assumes the well-known domain  protects this trust by limiting  
>> access to these special keys (denoted  by special selectors).  The  
>> well known service provider or  institution could have their  
>> administrative or transactional messages  obtain a trust  
>> annotation, without fearing one of their millions of  customers or  
>> less trustworthy employees will spoof other customers by  sending  
>> a hazardous message asking to apply a browser plug-in, for  example.
>
> Why would this need standardization? All a domain needs to do is  
> decide for itself which selector subdomains to organize the  
> different kinds of traffic it views as, well, different, and  
> reputation systems ought to be able to figure this out for  
> themselves. Indeed, they MUST be able to independently establish that.

Standardizing selector tags to represent the signatures of messages  
from vetted sources, allows a generic email viewing application to  
limit annotations of trust to such sources without being specifically  
tailored for each individual domain.

The generic indication of a message coming from a vetted source would  
be independent of any third-party assessments.  This would be  
exclusively a signer assertion.  The recipient could easily establish  
what domains they consider well-known.  To ease setup, well-known  
domain lists could be shared among users.  By establishing this  
convention, only the well-known domain name is listed.  Confusion  
created by endless details of all possible key selectors, sub- 
domains, and special email-addresses can thus be avoided.

The effort at restoring trust among consumers should not require  
reputation services.  Any violation of trust from a well-known domain  
would likely become news worthy, prompting users to edit their own  
lists as required.

-Doug