Subject: [ietf-dkim] 1360: ssp-requirements-01 // Designated Signing Domain Scenario missing

From: Douglas Otis <[email-masked]>
Date: Mon, 9 Oct 2006 11:12:44 -0700

https://rt.psg.com/Ticket/Display.html?id=1360

There has been support on the list for ensuring a designated signing  
domain mode of operation be retained as a viable option.  This added  
scenario clarifies that policy is able to make such designations.

Policy's designated signing domains can independently indicate that:

1) the signature is valid for the referenced email-address.

2) the referenced email-address is also valid.

This ability to designate a signing domain enables these two modes of  
operation, where the first mode does not modify how the MSA  
operates.  The first mode thus enables simpler compliance with an  
"all messages are signed" assertion while allowing free use of  
outside providers.  This would also be a continuation of 1359.  This  
mode of operation eliminates ISP coordination and specialized  
services for each email-address domain owner.

Designated domains over delegation offer significant advantages:

1) the domain authenticating outbound access and signing the
    message is identified.

2) abuse reporting is directed to the affected and actionable
    domain.

3) no additional administration is required for "all messages
    are signed" compliance.

4) private keys are never transferred to or held by a third-party.

5) validated email-addresses are bound to the access-account
    rather than the domain-owner's keys when asserting the
    email-address is valid.

6) the level of trust when asserting valid email-addresses
    remains within the control of the email-address domain owner.

7) Allowing ISPs to use a common key reduces key caching.

8) Policy assertions and email-address validity can be multiplexed
    with different designated signing domains.

-Doug

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Mon, 9 Oct 2006 12:25:05 -0700

On Oct 9, 2006, at 11:12 AM, Douglas Otis wrote:

> There has been support on the list for ensuring a designated  
> signing domain mode of operation be retained as a viable option.   
> This added scenario clarifies that policy is able to make such  
> designations.
>

For DKIM to offer protection, there must be message annotation that  
indicates when an email-address is asserted to be valid.  An "all  
messages are signed" may just increase the scrutiny given messages  
that are expected to have a valid signature.

To better clarify how domain designation might be used:

When complying with only the "all messages are signed" assertion, the  
following designation could apply:

<base-32(sha-1(big-isp.com))>._DKIM-F.my-domain.com
  	RR "d=big-isp.com; f=A"

When asserting the email-address is valid:

<base-32(sha-1(my-domain.big-isp.com))>._DKIM-F.my-domain.com
         RR "a=my-domain.big-isp.com; f=A"

In the latter example, rather than delegating a DNS zone, agreeing  
upon the publishing of key CNAMEs, or having the domain owner publish  
public keys generated by the provider at specific selectors, the  
domain owner has an option of independently publishing policy that  
indicates the email-address is valid (a=), in addition to the  
signature being valid (d=).  The provider may exclusively use the key  
at "my-domain.big-isp.com" for the access granted to "my- 
domain.com."  In this case, "my-domain.com" can assert general access  
signed by "big-isp.com" offers a valid signature for their domain,  
and that messages signed by "my-domain.big-isp.com" offers a valid  
email-address.  The difference is that the coordination required in a  
delegation process is avoided, where the customer is free to make  
these assertions as they desire at any later date.

-Doug

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 11 Oct 2006 15:06:54 +0100

There was also clear opposition in the jabber to including this.

However, on balance I don't feel comfortable saying where the
consensus lies here, so I've asked Barry to look over the logs
and list to see what he thinks,

Stephen.

Douglas Otis wrote:
> operation, where the first mode does not modify how the MSA operates.  
> The first mode thus enables simpler compliance with an "all messages are 
> signed" assertion while allowing free use of outside providers.  This 
> would also be a continuation of 1359.  This mode of operation eliminates 
> ISP coordination and specialized services for each email-address domain 
> owner.
> 
> 
> NOTE WELL: This list operates according 
> tohttp://mipassoc.org/dkim/ietf-list-rules.html
>