Subject: [ietf-dkim] user level ssp

From: Michael Thomas <[email-masked]>
Date: Wed, 06 Sep 2006 10:14:40 -0700

All of this talk about additional requirements for user level ssp ignores
the basic question: should there be any requirements for user level SSP
at all? If so, what are the use cases? I'm not terribly convinced that even
that has consensus -- this is the first that I even recall the subject being
raised.

       Mike
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Wed, 6 Sep 2006 11:00:10 -0700

On Sep 6, 2006, at 10:14 AM, Michael Thomas wrote:

>
> All of this talk about additional requirements for user level ssp  
> ignores the basic question: should there be any requirements for  
> user level SSP at all? If so, what are the use cases? I'm not  
> terribly convinced that even that has consensus -- this is the  
> first that I even recall the subject being raised.

When a large financial institution wishes to have a specific email- 
address receive added assurances via annotations, then having a means  
to include these addresses within policy satisfies this desire  
without specific arrangements made separately with each verifier.   
The current strategies for financial institutions require an  
assertion that _all_ messages be signed.  Not all messages from a  
large domain warrant receiving annotations of added assurances  
however.  Having a means to convey which email-address warrants this  
annotation can be accomplished via policy.

Rather than a direct translation into a DNS label, a base32 encoding  
of a SHA-1 hash ensures long local-parts, UTF-8, and subaddress  
symbols can be handled by this scheme. (SHA-256 could be used, but  
there does not seem to be a need for this extreme.)

-Doug

---

From: Damon <[email-masked]>
Date: Wed, 6 Sep 2006 14:45:24 -0400

> there does not seem to be a need for this extreme.)

+1

Regards,
Damon Sauer

---

From: Jon Callas <[email-masked]>
Date: Thu, 7 Sep 2006 12:09:52 -0700

On 6 Sep 2006, at 10:14 AM, Michael Thomas wrote:

> ignores

I think user-level *anything* with DKIM is a bad idea. There's a lot  
of flexibility in the system that permits someone so inclined to get  
to something within epsilon of user-level whatevers. However, putting  
it into the system is not a good idea.

	Jon

---

From: Douglas Otis <[email-masked]>
Date: Thu, 7 Sep 2006 12:22:03 -0700

On Sep 7, 2006, at 12:09 PM, Jon Callas wrote:

> I think user-level *anything* with DKIM is a bad idea. There's a  
> lot of flexibility in the system that permits someone so inclined  
> to get to something within epsilon of user-level whatevers.  
> However, putting it into the system is not a good idea.

The policy discussion is related to making specific policies for a  
particular email-address, without concerns at this time in how this  
is done.  This is not about making user level policies.  The DKIM  
base has limited the control of the signature to that of the email- 
address.  This email-address specificity is found in either the key  
g= or the signature i= parameters.

While a domain may wish to allow the bulk of their users a freedom to  
send messages to mailing-lists and e-invitese, perhaps only a  few  
email-addresses are set aside where extremely strict policy is  
applied.  This strict policy would otherwise disrupt most of the  
common services being used.  DKIM's basis of control is the email- 
address, not the user or subdomain.

-Doug