Subject: [ietf-dkim] Base-02 signature process clarification requested

From: Douglas Otis <[email-masked]>
Date: Tue, 6 Jun 2006 18:15:53 -0700

,---
|3.5 The DKIM-Signature header field
|...
| The "DKIM-Signature:" header field is always included in
| the signature calculation, after the body of the message;
| however, when calculating or verifying the signature, the
| value of the b= tag (signature value) MUST be treated as
| though it were the null string. Unknown tags MUST be signed
| and verified but MUST be otherwise ignored by verifiers.
'___

What is not clear is when a DKIM-Signature is included within the h=  
parameter, for this instance of the header field is the b= tag also  
treated as a null string?

-Doug 
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eliot Lear <[email-masked]>
Date: Wed, 07 Jun 2006 08:56:03 +0200

Doug,
> treated as a null string?
How can it verify otherwise?

Eliot

---

From: Douglas Otis <[email-masked]>
Date: Wed, 07 Jun 2006 05:47:12 -0700

> How can it verify otherwise?

The signature being created or verified is not included within the h=
list (list of headers being signed.).  

-Doug

---

From: Tony Hansen <[email-masked]>
Date: Wed, 07 Jun 2006 09:01:46 -0400

You have to differentiate between a DKIM-Signature header that's being
created and/or verified, and a DKIM-Signature that was there previously
and has now been included in the list of headers that are part of the
message being signed and/or verified.

The b= nullification applies only to the DKIM-Signature being created
and/or verified. It does not apply to any other DKIM-Signature headers
that may be included as part of the message header.

When I read -base, this seemed clear enough to me.

	Tony Hansen
	[email-masked]

Douglas Otis wrote:
>> Doug wrote,

---

From: Douglas Otis <[email-masked]>
Date: Wed, 07 Jun 2006 07:19:03 -0700

> When I read -base, this seemed clear enough to me.

It would seem this is also not very clear either:

,---
| 3.7  Computing the Message Hashes
|
| 2.  The "DKIM-Signature" header field that exists (verifying) or will
|    be inserted (signing) in the message, with the value of the "b="
|    tag deleted (i.e., treated as the empty string), canonicalized
|    using the header canonicalization algorithm specified in the "c="
|    tag, and without a trailing CRLF.
|
| All tags and their values in the DKIM-Signature header field are
| included in the cryptographic hash with the sole exception of the
| value portion of the "b=" (signature) tag, which MUST be treated as
| the null string.  All tags MUST be included even if they might not be
| understood by the verifier.  The header field MUST be presented to
| the hash algorithm after the body of the message rather than with the
| rest of the header fields and MUST be canonicalized as specified in
| the "c=" (canonicalization) tag.  The DKIM-Signature header field
| MUST NOT be included in its own h= tag.
'---

Where is the text that describes the different treatment of a previously
existing DKIM-Signature header?

-Doug

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 07 Jun 2006 15:41:36 +0100

Doug,

> It would seem this is also not very clear either:

Better to suggest alternative text unless you cannot,

Stephen.