Subject: RE: [ietf-dkim] Re: Additional lookups

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 3 Mar 2007 14:08:34 -0800

> From: John Levine [mailto:[email-masked]] 

> No, I was arguing that a sender's opinion about the relative 
> merits of algorithms is useless to a receiver, so there is no 
> point in publishing it.  Wietse summarized the reasonable 
> approach to verifying signatures well enough that I won't try 
> and do so again.

True, but not what is being proposed.

What is at issue is not what the sender thinkg of the algorithm. All that is at issue is describing what they do

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John L <[email-masked]>
Date: Sat, 3 Mar 2007 17:12:31 -0500 (EST)

> What is at issue is not what the sender thinkg of the algorithm. All 
> that is at issue is describing what they do

Understood, but since what the sender does in this case has no effect on 
how a receiver handles incoming mail, there's still no point in publishing 
it.

R's,
John

---

From: Damon <[email-masked]>
Date: Sat, 3 Mar 2007 21:45:13 -0500

It could be considered as a way of faster adoption.
If I am a receiver and I am getting a lot of spam because I am not
able to verify a particular algorithm, then maybe I should start...
Self-correcting issue.

Regards,
Damon Sauer

---

From: Douglas Otis <[email-masked]>
Date: Sat, 3 Mar 2007 23:19:31 -0800

On Mar 3, 2007, at 2:12 PM, John L wrote:

>> What is at issue is not what the sender thinkg of the algorithm.  
>> All that is at issue is describing what they do
>
> Understood, but since what the sender does in this case has no  
> effect on how a receiver handles incoming mail, there's still no  
> point in publishing it.

John,

Imagine there is an improved algorithm for handling a DKIM related  
issue now permitting some type of exploit.  For the sake of argument,  
the issue is not catastrophic, nor related to crypto-graphic signing  
or hashing.  It could be how headers are associated with signatures,  
how multiple email-addresses are handled, how UTF-8 is handled, etc,  
etc.

Some percentage of signers will introduce a new strategy that  
curtails the foreseen problem.  Only when a verifier can easily  
confirm whether a signers has upgraded, will it be practical to  
detect when a bad actor has downgraded the message.  Depending upon  
overlapping signatures makes an unfounded assumption.  It is likely  
that in the presence of difficult to associate multiple signatures,  
overlapping may prove fragile.  Defining an optional "deprecation"  
parameter for the key offers a safe transition that can accommodate  
_any_ DKIM related algorithm or service.

Abruptly eliminating a prior algorithm, and introducing a new one  
before it achieves broad support will prove highly disruptive.   
Achieving broad support may also take years, especially when the  
issues affects only a portion of the recipients, as can easily  
happen.  You can not claim that what a signer does has no effect on  
how a verifier handles a message.  When you trust the signing domain,  
then knowing their strongest option can defeat an exploit once both  
the verifier and signer have upgraded.  Your approach postpones this  
protection until problematic algorithm can be universally obsoleted.   
This assumption could prove costly.

-Doug

---

From: John L <[email-masked]>
Date: Sun, 4 Mar 2007 02:38:29 -0500 (EST)

> Abruptly eliminating a prior algorithm, and introducing a new one before it 
> achieves broad support will prove highly disruptive.

Since nobody has suggested doing that, I don't understand what your point 
is.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Sat, 3 Mar 2007 23:50:16 -0800

On Mar 3, 2007, at 11:38 PM, John L wrote:

> Since nobody has suggested doing that, I don't understand what your  
> point is.

When two options are possible, knowing whether the signer's algorithm  
for the message has been downgraded.

-Doug

---

From: John L <[email-masked]>
Date: Sun, 4 Mar 2007 02:53:45 -0500 (EST)

> When two options are possible, knowing whether the signer's algorithm for the 
> message has been downgraded.

The only two options of any importance to a receiver are "has a valid 
signature" or "doesn't have a valid signature."  No amount of sender 
policy blather about allegedly upgraded, downgraded, or sidegraded 
signing algorithms makes any difference.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Sun, 4 Mar 2007 00:30:22 -0800

On Mar 3, 2007, at 11:53 PM, John L wrote:

>> When two options are possible, knowing whether the signer's  
>> algorithm for the message has been downgraded.
>
> The only two options of any importance to a receiver are "has a  
> valid signature" or "doesn't have a valid signature."  No amount of  
> sender policy blather about allegedly upgraded, downgraded, or  
> sidegraded signing algorithms makes any difference.

There will be questions about whether a message is abusively being  
replayed. There may be questions about what email-address is  
assured.  Assurances could become problematic when the signing  
domains and the email addresses are expressed differently.

-Doug

---

From: John L <[email-masked]>
Date: Sun, 4 Mar 2007 03:36:03 -0500 (EST)

> There will be questions about whether a message is abusively being replayed. 
> There may be questions about what email-address is assured.  Assurances could 
> become problematic when the signing domains and the email addresses are 
> expressed differently.

Um, this must be a different DKIM than the one in the -10 draft.

R's,
John

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 04 Mar 2007 13:56:34 +0000

Douglas Otis wrote:
> replayed. There may be questions about what email-address is assured.  
> Assurances could become problematic when the signing domains and the 
> email addresses are expressed differently.

Doug,

This isn't a debating society. Please don't continue to try drag us
back to arguments that were settled months ago. (You're not the
only one, but the above paragraph is a very good example;-)

S.

---

From: Douglas Otis <[email-masked]>
Date: Sun, 4 Mar 2007 11:07:56 -0800

> only one, but the above paragraph is a very good example;-)

One aspect in reference was the impact of EAI, which was never fully  
discussed, nor has there ever been a conclusion reached regarding  
message replay.  John's conclusion was that the only issue facing  
DKIM is whether a signature can be verified.  This indeed overlooks  
areas this WG intentionally ignored.  A deprecation scheme simply  
permits a graceful transition should experience prove ignoring these  
concerns was in error.  Too many wish to equate DKIM message signing  
reliability as being synonymous with the underlying cryptography; it  
is not.

-Doug