Subject: RE: [ietf-dkim] Deployment Scenario 7: Cryptographic Upgrade andDowngrade Attacks

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 23 Feb 2007 13:18:33 -0800

> [mailto:[email-masked]] On Behalf Of Dave Crocker

> Color me confused.  I thought we agreed long ago that 
> downgrade attacks were not an issue for the problem DKIM addresses.

This was ONLY agree for DKIM-core.

The entire point of policy is to prevent downgrade attacks. That is what is meant by making an inference from the absence of a signature.

> More basically, we are moving quickly into the morass of 
> requiring SSP lookups for signed messages, rather than 
> limiting SSP for use with unsigned messages.

Not at all, you only look at policy if you don't find a signature that sufficiently demonstrates authenticity.

If I support verification of algorithm A (and not B) then I only look up the policy record if I receive a message with no signature at all or a signature that I can't verify (e.g. B) or which fails verification.

>     Hence, SSP should be used for receipt of unsigned 
> messages.  Statements like "I sign everything" and "I send no 
> mail" are examples.

Agreed on #1.

#2 is NOT a DKIM policy statement but it is a statement that someone might want to make in a policy language which gets to the point of are we talking about a DKIM policy language or DKIM statements within a policy language with a syntax that is capable of making more general statements?

I see utility in the folowing policy statements:

DKIM              - I ALWAYS sign with DKIM
DKIM=<selector>   - I ALWAYS sign with a DKIM signature where the 
                    key selector has the specified suffix
DKIM-TEST         - I MIGHT sign with DKIM, I am testing
PHISHING-TARGET   - Be advised that I consider myself a phishing target
NOMAIL            - I never ever send mail
REPORT=<Protocol> - Errors may be reported using the following protocol(s)
SPF [=domain]     - Look at the SPF record as well

In addition we might add for completeness:

SMIME             - I ALWAYS sign with S/MIME
PGP               - I ALWAYS sign with OpenPGP

As far as DKIM goes I only consider DKIM, DKIM=<selector> and possibly DKIM-TEST to be DKIM policies. The others are email sending policies, not DKIM policies.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Fri, 23 Feb 2007 16:53:47 -0500

Hallam-Baker, Phillip wrote:

> Not at all, you only look at policy if you don't find 
 > a signature that sufficiently demonstrates authenticity.
> 
> If I support verification of algorithm A (and not B) then I only look up 
 > the policy record if I receive a message with no signature at all
 > or a signature that I can't verify (e.g. B) or which fails verification.

My engineering tells me a SSP lookup first at all times will be more 
efficient with less overhead and highest benefits across the board if 
everyone followed this optimization.

The assumption being made is that all first party valid signatures are 
"OK" and do not have vulnerabilities.

Well, that might be the case, after all, if the first party is 
exploited, then its SSP is exploited too.

But its a chicken and egg situation that comes with an inherent overhead 
- DKIM processing is heads and shoulders HIGHER in overhead than SSP.

The issue is this:

X represents the amount of VALID DKIMS in the haystack of mail
Y represents the amount BAD MAIL in the haystack of mail.
Z represents the amount DKIM signatures in  Y

By the very nature of this problem, Y > X, otherwise we wouldn't be 
here.  Therefore the higher the percentage of Z in Y, the more overhead 
you have.

If each domain has a DKIM DOMAIN policy, overhead is reduced simply 
based on the fundamental concept that there is more bad mail than good.

Can't ignore that.

This is akin to checking for RCPT first before applying any high 
overhead HELO/EHLO or MAIL FROM validation concept.

--
HLS

---

From: Douglas Otis <[email-masked]>
Date: Fri, 23 Feb 2007 14:44:35 -0800

On Feb 23, 2007, at 1:53 PM, Hector Santos wrote:

> here.  Therefore the higher the percentage of Z in Y, the more  
> overhead you have.
>

Why do you consider this to be true?  Cad actors are setting up  
complete domains every 5 minutes.  All of this does not cost the bad  
actor anything.  Adding valid DKIM signatures and policies represents  
significantly less resource consumption for bad actors than it does  
for the millions of recipients.  With domains changing every few  
minutes, chasing after bogus domains will be fairly futile.

> overhead HELO/EHLO or MAIL FROM validation concept.

Unless the signing domain is recognized, validating signatures  
consumes resources and also indicates the level of acceptance  
obtained, for substantially little actionable benefit for the  
recipient.  Any filter that attempts to protect DKIM signature  
verification will be quickly thwarted by information leaking to the  
bad actors.

-Doug