Subject: [ietf-dkim] Remainder of last jabber not covered + new issue

From: Douglas Otis <[email-masked]>
Date: Mon, 5 Jun 2006 07:55:24 -0700

Remainder from last jabber:

K. Otis, signature removal
	http://mipassoc.org/pipermail/ietf-dkim/2006q2/003764.html

L. Otis, signature expiration
	http://mipassoc.org/pipermail/ietf-dkim/2006q2/003765.html

M. Otis, signing address
	http://mipassoc.org/pipermail/ietf-dkim/2006q2/003768.html

New issue:

http://mipassoc.org/pipermail/ietf-dkim/2006q2/003796.html
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eliot Lear <[email-masked]>
Date: Mon, 05 Jun 2006 17:24:59 +0200

>     http://mipassoc.org/pipermail/ietf-dkim/2006q2/003765.html

And how does this differ from the previous discussion on this topic? 
You talk about DSNs, but in vague terms.  Nobody should ever issue a DSN
because of an expired signature, and I don't see how a DSN with an
expired signature would be treated any differently than any other
unsigned DSN or unsigned message for that matter.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Mon, 05 Jun 2006 17:29:22 +0200

>     http://mipassoc.org/pipermail/ietf-dkim/2006q2/003764.html

Now 1287.
>     http://mipassoc.org/pipermail/ietf-dkim/2006q2/003768.html

Now 1288.
> http://mipassoc.org/pipermail/ietf-dkim/2006q2/003796.html
Already in the system as 1286.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Michael Thomas <[email-masked]>
Date: Mon, 05 Jun 2006 09:14:43 -0700

>>    http://mipassoc.org/pipermail/ietf-dkim/2006q2/003764.html
Wait a minute, hasn't this been discussed ad nauseum with the clear
consensus to leave this text in?

       Mike

---

From: Eliot Lear <[email-masked]>
Date: Mon, 05 Jun 2006 18:26:03 +0200

In fact I think we have, and it may have been a mistake to open this
one.  Can the chairs please advise?

Eliot

---

From: Douglas Otis <[email-masked]>
Date: Mon, 5 Jun 2006 09:37:24 -0700

> consensus to leave this text in?

Do you have a reference to this discussion?  The concern raised is  
about the normative language in the -base draft regarding the removal  
of signatures.

  Signers SHOULD NOT remove any DKIM-Signature header fields from
  messages they are signing, even if they know that the signatures
  cannot be verified.

When a provider becomes aware of a technique creating a DoS exploit  
by adding signatures tar-pitting recipients, this language appears to  
discourage a defensive action.  DKIM base has yet to resolve how to  
handle multiple signatures or consider any related DoS issues.  Until  
then, it seems cavalier to indicate, even if the signature is known  
to be invalid, all existing signatures must be retained.

It seems a growing portion of email content might become invalid  
signatures.

-Doug

---

From: Michael Thomas <[email-masked]>
Date: Mon, 05 Jun 2006 09:48:41 -0700

> about the normative language in the -base draft regarding the removal  

Yes, we've definitely had this conversation before.

> It seems a growing portion of email content might become invalid  
I've seen exactly the opposite.

       Mike

---

From: Douglas Otis <[email-masked]>
Date: Mon, 5 Jun 2006 10:10:38 -0700

On Jun 5, 2006, at 9:48 AM, Michael Thomas wrote:

>> Do you have a reference to this discussion?  The concern raised  
>> is  about the normative language in the -base draft regarding the  
>> removal  of signatures.
>

So the current practice is to not retain invalid signatures?

Such a strategy seems remarkably prescient.

Prior conversations related, mostly between Paul and yourself,  was  
in regard to an algorithm transition.  These conversations did not  
adequately cover many security related details.   The details of  
handing such a transition are still not clear, nor is it clear how a  
prior invalid signature adds protection.  The topic of DoS related  
considerations or a growing invalid signature content is added by the  
concern expressed as new territory.

-Doug

---

From: Barry Leiba <[email-masked]>
Date: Mon, 05 Jun 2006 15:17:43 -0400

>  messages they are signing, even if they know that the signatures

Well, it's easy to sort out whether we've had sufficient discussion:
Does anyone support Doug's request to remove this text?  If you do, 
please respond here by Thursday's jabber chat.

Barry

--
Barry Leiba, Internet Messaging Technology  ([email-masked])
http://www.research.ibm.com/people/l/leiba
http://www.research.ibm.com/spam
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 05 Jun 2006 20:49:18 +0100

> please respond here by Thursday's jabber chat.

Agree. And I for one will only pay attention to *clear* indications
of support. Going off and discussing other issues is fine, but not
relevant in answering Barry's question,

Stephen.

PS: The jabber sessions seem fairly efficient for disposing of issues
where there is only one voice calling for a change with a clear
consensus against, so there may be cases where its quicker to dispose
of an issue that way rather than have extended debate about its
originality or relevance. (Of course, if such an issue ever does
engender support on the list, that trumps the jabber chat.)