Subject: [ietf-dkim] #1398 (was: Today's jabber notes...)

From: Frank Ellermann <[email-masked]>
Date: Thu, 01 Mar 2007 22:07:02 +0100

Michael Thomas wrote:

> We need to define at least one binding between a DKIM signature
> and an outside 2822 origination address.  I think there's pretty
> good agreement that 2822.From is a very interesting address.

So far that's decided in -base, for a present (valid) signature.

> The question you raise, I think, is whether there are other
> addresses like Sender, etc.

My question is about mails without (valid) signature.

> nothing prevents you from doing an SSP lookup on any address or
> domain that you desire, so at some level you are accommodated.

No, it's not obvious what it means if the 2822-From domain claims
to sign all mails, and the Resent-From domain makes no statement.

> Does there really need to be anything more formal at this point?

Yes, receivers need to know that those obscure Resent-* cases, or
more likely Sender cases exist, they are permitted in 2822 mail.
If the sender (or resender) did nothing wrong, the 2822-From SSP
MUST be ignored.  Maybe for pure mail scenarios we could get away
with a "if there was a valid signature you're suppoosed to keep
it as resender (or sender)" strategy, but that's not good enough
for cases like news2mail.

> I hope not because it likely a deep rathole that in the end isn't
> too likely to change anything in the protocol itself

An attempt to finish off Errors-To "officially" is on its way (*).
Anything related to "PRA" is messy, but hand-waving does not help.

I'd love it if somebody could decree that Resent-* is confusing +
unnecessary + harmful + obsolete (pick all :-), but it just won't
happen before ssp-requirements-03.

Frank

*: <http://permalink.gmane.org/gmane.ietf.message-headers/35>

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Michael Thomas <[email-masked]>
Date: Thu, 01 Mar 2007 13:56:10 -0800

> to sign all mails, and the Resent-From domain makes no statement.

In my implementation I can (and do) sign for a configurable set of
addresses including From, Sender, Listid, etc. SSP has the concept
of "I sign everything" which right now is implicitly the From address.
What I'm wondering is whether we should make that binding more
explicit even if we ultimately only choose From, and make it an
extensible list sort of like:

p=sign-complete:From;

Perhaps now, perhaps in the future we could extent that to be
something like:

p=sign-complete:From:Sender:Listid;

Which I'm pretty sure addresses your issue directly.

       Mike

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 02 Mar 2007 16:52:31 +0100

> Perhaps now, perhaps in the future we could extent
> that to be something like:

> Which I'm pretty sure addresses your issue directly.

Yes, that could make sense.  It has to be clear that
there could be _legit_ corner cases (e.g. news2mail),
where using a 2822-From-SSP to reject mails is ugly,
and where abusing it to drop mails is bad.

Frank

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 02 Mar 2007 17:47:48 +0000

This mail is for Eliot's benefit so he can officially close
stuff in the tracker.

Eliot the "       - CLOSE" bits are the ones you want

1356, 1357, 1362, 1363: Mike to check with Dave Crocker that
       these can now be safely CLOSED.
         - CLOSE
1360: CLOSED barring list objections
         - CLOSE
1364: Mike to check with Dave again, thinks this can be CLOSED.
         - CLOSE
1365: Eric to check on list if we have consensus to drop 5.3 requirement 2,
         - CLOSE
1383: CLOSED - we decided that in San Diego
         - CLOSE
1386: Not clear what the requirement is - Mike to mail PHB asking for
       clarification
         - CLOSE - PHB's suggested text to be included in -03 & poll WG
           thereafter
1398: Eric to raise this on the list - want clarification from Frank
	- CLOSE (?)
1399: Mike to add a requirement like "the protocol MUST be crystal
       clear as to when SSP must be invoked" and then CLOSE this
	- TBD so still OPEN
1402: Stephen to raise on the list & add to Prague agenda
	- OPEN
1408: Jabberers wanted to CLOSE this one with no change
	- CLOSE

There's been a lot of list traffic recently so if folks could
check I've not made a mistake there that'd be good.

Stephen.

Stephen Farrell wrote:
> 
> ..attached. Please check to see if something you care about
> was discussed since there weren't enough people present
> to be confident of rough consensus.
> 
> Stephen.
> 
> 
> 
> ------------------------------------------------------------------------
>

---

From: Eliot Lear <[email-masked]>
Date: Fri, 02 Mar 2007 19:24:36 +0100

Done as requested.

Have a good weekend.

---

From: Michael Thomas <[email-masked]>
Date: Fri, 02 Mar 2007 14:15:05 -0800

We can close 1399 too.

This leaves 1382 as the only one that we haven't discussed to my
knowledge.

Also: since I still haven't heard anything about whether anybody cares
about the local part stuff, I'm going to nuke it unless there is a huge 
uproar.

       Mike