Subject: [ietf-dkim] Straw poll on x=

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Apr 2006 15:43:29 +0100

Folks,

I've just been chatting with Barry and we don't see this discussion
heading towards a consensus so far, which makes our job harder.
So, to remedy that, (my life being more difficult:-), we'd like to
have a bit of a straw poll on this topic, just so, as chairs, we're
clear on who thinks what.

We're asking those with an opinion to respond to this mail (on the
list) saying whether you prefer to get rid of "x=", or prefer
keeping "x=". If you prefer something else, then you can start a
different thread. If you want to continue discussing this issue,
then do so using the current threads - we don't want to stop anyone
who has new thoughts on the matter.

If there is no clear consensus Barry and I think that the right
thing to do in this case is to stick with the status quo.

We'll collate the results in a week (since its a holiday weekend
for many folks) and let you know.

So, if you care, please respond to this message, including the list,
with one of:

    Get rid of "x="

...or...

    Keep "x="

...and no discussion.

Thanks,
Stephen.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jonathan Clark <[email-masked]>
Date: Tue, 11 Apr 2006 11:03:46 -0400

Keep "x=".

Jonathan

---

From: John Levine <[email-masked]>
Date: 11 Apr 2006 15:07:43 -0000

>    Get rid of "x="

R's,
John

---

From: Michael Thomas <[email-masked]>
Date: Tue, 11 Apr 2006 08:22:06 -0700

Keep "x="

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 11 Apr 2006 11:25:00 -0400

Keep "x="

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

----- Original Message -----
From: "Stephen Farrell" <[email-masked]>

---

From: Douglas Otis <[email-masked]>
Date: Tue, 11 Apr 2006 08:43:58 -0700

Get rid of "x="

-Doug

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 11 Apr 2006 09:28:09 -0700 (PDT)

> who has new thoughts on the matter.

Preferred choice: make "x" optional with default 2-week value otherwise
Alternative choice: keep "x" as it is now

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: "Dennis Dayman" <[email-masked]>
Date: Tue, 11 Apr 2006 12:35:57 -0500

Keep x 

-Dennis

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 11 Apr 2006 13:32:04 -0700

At 3:43 PM +0100 4/11/06, Stephen Farrell wrote:
    Get rid of "x="
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jim Fenton <[email-masked]>
Date: Tue, 11 Apr 2006 17:11:31 -0700

Keep "x="

-Jim

---

From: Eliot Lear <[email-masked]>
Date: Wed, 12 Apr 2006 07:39:02 +0200

Get rid of x=.

Eliot

---

From: Jim Fenton <[email-masked]>
Date: Wed, 12 Apr 2006 17:11:14 -0700

Vote change:

Get rid of "x=" (and also "t=", while you're at it).

-Jim

---

From: "Miles libbey" <[email-masked]>
Date: Thu, 13 Apr 2006 10:03:48 -0700

>     Get rid of "x="

I find the 'this is a transit spec' and 'have the sender maintain
responsibility' arguments compelling.

miles

---

From: Arvel Hathcock <[email-masked]>
Date: Thu, 13 Apr 2006 14:13:57 -0500

I can't make up my mind so I will abide by the collective wisdom (sorry 
not much help to either side).

-- 
Arvel

---

From: Jim Hill <[email-masked]>
Date: Fri, 14 Apr 2006 02:37:40 +0100

---

From: Jon Callas <[email-masked]>
Date: Mon, 17 Apr 2006 11:34:37 -0700

Keep "x="

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 18 Apr 2006 18:05:08 +0100

Last call for opinions. I'm gonna count 'em up when I
get home and send results in a few hours.

Cheers,
S.

---

From: Tony Hansen <[email-masked]>
Date: Tue, 18 Apr 2006 13:45:53 -0400

step 1) remove it
step 2) decide what we really want
step 3) propose something with those exact semantics

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 18 Apr 2006 14:50:55 -0400

> get home and send results in a few hours.

I prefer KEEP X=

Please note: It is already optional. If people don't want to use it, they
don't have to add it to the signature.

If kept,  we need one spec bug fix:

| 6.2  Get the Public Key
|
|  ...
|
+   0.  If signature has an expiration (x=) tag, check if the signature
+       has expired. Signatures MUST NOT be considered valid if the
+       current time at the verifier is past the expiration date.
+
|   1.  Retrieve the public key as described in (Section 3.6) using the
|       domain from the "d=" tag and the selector from the "s=" tag.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 18 Apr 2006 21:58:00 +0100

Results are in:

Keep (8)

[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]

Remove (9)

[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked] (Jim Hill)
[email-masked]

And that includes a vote that changed sides! Let me know
if I've missed anyone, but I suspect it won't make a
difference really.

So there is no clear consensus to delete x=, therefore
we go with the status quo.

Could I ask that someone try propose text for the draft
to clarify the meaning of x=, bearing in mind all of
the list discussion?

Stephen.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 18 Apr 2006 14:24:07 -0700

>we go with the status quo.

Right.

>to clarify the meaning of x=, bearing in mind all of

The meaning of x= is completely clear in the -00 and -01 drafts. 
However, many people on the list, including some of the document 
authors, have wide disagreement about what x= is supposed to do. Some 
people say that it is supposed to be when a particular signature is 
no longer valid; others say that it is when the recipient should not 
expect to find the signing key available; others say that it is when 
the signing system is no longer responsible for the message; others 
say it is a combination of those. If someone can come up with a 
consensus statement from the recent list traffic, that's great; I 
failed.

Instead of clarifying, we need to associate semantics with x=, even 
if those are "the signer can cause signature expiration for any 
reason without saying why".
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 18 Apr 2006 22:29:10 +0100

Paul Hoffman wrote:
> people say that it is supposed to be when a particular signature is no 
> longer valid; others say that it is when the recipient should not expect 
> to find the signing key available; others say that it is when the 
> signing system is no longer responsible for the message; others say it 
> is a combination of those. If someone can come up with a consensus 
> statement from the recent list traffic, that's great; I failed.
> 
> Instead of clarifying, we need to associate semantics with x=, even if 
> those are "the signer can cause signature expiration for any reason 
> without saying why".

Fair enough, "clarify" was maybe the wrong word, except that
if as you say the meaning is being interpreted in different
ways, then it seems we do need more text to say which of those
it is, or at least to say that it doesn't mean the other
things.

S

---

From: Michael Thomas <[email-masked]>
Date: Tue, 18 Apr 2006 16:32:43 -0700

Paul Hoffman wrote:

> longer valid; 

That's what the draft says. There are many other cases of "invalid". I don't
see why this is a hard concept.

> others say that it is when the recipient should not expect to find the 
> signing key available; 

That might be  a reason to use x= in the first place, but that gets into 
BCP land, IMO.

> others say that it is when the signing system is no longer responsible 
> for the message; 

That current draft does not attach any normative semantics to 
"responsible" so
from a semantics standpoint so they all revert back to the base level 
semantics
of having or not having a valid signature: information for the receiver 
to use
to apply local policy.

> others say it is a combination of those. If someone can come up with a 
> consensus statement from the recent list traffic, that's great; I failed.
>

That's what the current draft implies. I don't know why we need a
normative behavior, any more than we need to have a normative behavior
for aging keys. It would be nice to have discussion in a BCP,  but that's
very different than laying down the law in a standard's track draft.

       Mike