Subject: [ietf-dkim] issue with relaxed body canonicalization?

From: Tony Hansen <[email-masked]>
Date: Fri, 09 Jun 2006 13:12:46 -0400

Since we're talking about possibly WGLCing base, there's an issue that
needs to be resolved. In section 3.4.4, there's this note:

   3.4.4  The "relaxed" Body Canonicalization Algorithm

   [[This section may be deleted; see discussion below.]]  The "relaxed"
   body canonicalization algorithm: ....

      [[NON-NORMATIVE DISCUSSION:  The authors are undecided whether to
      leave the "relaxed" body canonicalization algorithm in to the
      specification or delete it entirely.  We believe that for the vast
      majority of cases, the "simple" body canonicalization algorithm
      should be sufficient.  We simply do not have enough data to know
      whether to retain the "relaxed" body canonicalization algorithm or
      not.]]

Do we have enough data yet to make a decision on this? Do we have data
to back things up, one way or the other? Do we have proof of cases where
a relaxed body passes verification but a simple body does not?

Are any MTAs currently *signing* using relaxed bodies? If yes, then the
answer to the above question is moot and we should keep it.

	Tony Hansen
	[email-masked]
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 9 Jun 2006 17:55:57 -0000

>a relaxed body passes verification but a simple body does not?

This sounds like it's related to the milter bug that munges spaces
around the colon in a header line.  Did we ever decide whether the
milter interface is likely to get fixed, we should write our spec
to live with it, or something else?

R's,
John

---

From: Tony Hansen <[email-masked]>
Date: Fri, 09 Jun 2006 16:08:37 -0400

This is a totally separate issue. Please discuss that issue in a
separate thread.

	Tony Hansen
	[email-masked]

---

From: Michael Thomas <[email-masked]>
Date: Fri, 09 Jun 2006 13:36:51 -0700

>answer to the above question is moot and we should keep it.
I have the ability to sign with a relaxed body, but I don't have any
data as to whether it makes any difference -- simple _seems_ to be
working pretty well though. Maybe this would be a good thing to
just leave in and decide to remove at draft standard time?

          Mike

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 10 Jun 2006 08:18:42 -0700

>just leave in and decide to remove at draft standard time?

In security protocols, it is generally a bad thing to include in 
options that take a fair amount of processing and that are not 
well-tested. If non one has a proven use case for this option, it 
would be better to remove it now.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Arvel Hathcock <[email-masked]>
Date: Sat, 10 Jun 2006 15:53:14 -0500

> Are any MTAs currently *signing* using relaxed bodies? If yes, then
 > the answer to the above question is moot and we should keep it.

Ours has the ability to do it but our default is simple for headers and 
body.  I also have no data as to whether this makes any difference (sorry).

-- 
Arvel