Subject: [ietf-dkim] All done on potential SSP requirements?

From: Stephen Farrell <[email-masked]>
Date: Fri, 04 Aug 2006 11:59:49 +0100

Folks,

We've batted about a load of stuff this week on SSP requirements.
Some of it was new, some repeated from earlier rounds of discussion,
but all of stuff we needed to go over. But I guess that Mike now
has *plenty* of material to write up his reqs-00 I-D (which
he'll hopefully still manage to keep very short:-)

Rather than try resolve our different opinions based on these list
threads, I reckon we'd probably be better off waiting to and try
get consensus on requirements until after we've seen them written
down, so I suggest we let this week's discussion rest for a little
bit while Mike writes.

However, are there any potential SSP requirements that we've not
mentioned at all this past week or so?

Stephen.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 4 Aug 2006 08:03:11 -0400

Oh well, there goes the last input :-)

This is good Stephen.  I am looking forward for Mike's work.

I can only hope Mike has taken into account all considerations and input
even from those he wishes to either ignore or disagrees with.  In my
opinion, I would rather see larger set of requirements which can then be
prune down once we have a focused list or requirements, as opposed to having
a lopsided short list which will most likely guarantee a new round of heated
battles to add more key considerations that were talked about but ignored.

The last thing the DKIM Policy or SSP proponents will want to see is a
lopsided, one-sided highly subjective conclusion for a list of requirements
that intentionally ignores key concerns from others.  It would be a waste of
time.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

---

From: Jeff Macdonald <[email-masked]>
Date: Fri, 4 Aug 2006 08:27:14 -0400

On Fri, Aug 04, 2006 at 08:03:11AM -0400, Hector Santos wrote:
<snip>
> I would rather see larger set of requirements which can then be prune
> down once we have a focused list or requirements, as opposed to
> having a lopsided short list which will most likely guarantee a new
> round of heated battles to add more key considerations that were
> talked about but ignored.

+1

-- 
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | [email-masked]
:: 131 Hartwell Ave. | Lexington, MA 02421 
:: v: 781-372-1922 | f: 781-863-8118 
:: www.e-dialog.com

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 4 Aug 2006 09:24:27 -0400

----- Original Message -----
From: "Stephen Farrell"

> mentioned at all this past week or so?

Throughout all this, I tried to keep my contribution as generic as possible
sticking with protocol implementation and security issues. I don't know if a
specific item was missed or already covered, but my own input is best
summarized from the DSAP I-D proposal [1] as:

Goal:

   o  Protect domain DKIM message signing practices,
   o  Protect domain reputations,
   o  Reduce DKIM verification overhead,
   o  Simplify DKIM implementation design considerations,
   o  Help increase DKIM acceptability, and
   o  Help lower DKIM adoption barriers.

Security Considerations:

   o  Does the domain ever distribute mail?
   o  Do you expect the mail to be unsigned?
   o  Do you expect to sign all mail?
   o  Is your domain the exclusive signer?
   o  Are 3rd party signers or signatures allowed?
   o  Are 3rd party signers allowed to strip your original signatures?

[1] http://tools.ietf.org/wg/dkim/draft-santos-dkim-dsap-00.txt