Subject: [ietf-dkim] ISSUE: Rename SSP to ASP

From: Dave Crocker <[email-masked]>
Date: Tue, 12 Feb 2008 09:14:32 -0800

The practices that SSP describe are specific to the RFC2822 From: header field, 
which defines the author of a message.  It does not seek to describe practices 
of other agents in email handling.

As such, the name of the specification should reflect its precise scope.  The 
current name of "Sender" Signing Practices is imprecise and misleading.

The name should be changed to Author Signing Practices (ASP).

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Arvel Hathcock <[email-masked]>
Date: Tue, 12 Feb 2008 11:37:43 -0600

> The name should be changed to Author Signing Practices (ASP).

+1 for all the reasons Dave mentioned.

Arvel

---

From: Hector Santos <[email-masked]>
Date: Tue, 12 Feb 2008 12:54:27 -0500

Dave Crocker wrote:
> The practices that SSP describe are specific to the RFC2822 From: header 
> field, which defines the author of a message.  It does not seek to 
> describe practices of other agents in email handling.
> 
> As such, the name of the specification should reflect its precise 
> scope.  The current name of "Sender" Signing Practices is imprecise and 
> misleading.
> 

Wow, the final stage of the coup d'etat.  Fascinating.

-- 
Sincerely

Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Tue, 12 Feb 2008 13:03:10 -0500

>-----Original Message-----
>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of Dave Crocker
>Sent: Tuesday, February 12, 2008 12:15 PM
>To: [email-masked]
>Subject: [ietf-dkim] ISSUE: Rename SSP to ASP
>
>The practices that SSP describe are specific to the RFC2822 
>From: header field, which defines the author of a message.  It 
>does not seek to describe practices of other agents in email handling.
>
>As such, the name of the specification should reflect its 
>precise scope.  The current name of "Sender" Signing Practices 
>is imprecise and misleading.
>

If a name change is actually being considered I would suggest Author
Domain Signing Practices (ADSP) is actually more precise and
descriptive.

Mike

---

From: [email-masked] (Wietse Venema)
Date: Tue, 12 Feb 2008 13:21:49 -0500 (EST)

Dave Crocker:
> The practices that SSP describe are specific to the RFC2822 From:
> header field, which defines the author of a message.  It does not
> seek to describe practices of other agents in email handling.
>
> scope.  The current name of "Sender" Signing Practices is imprecise
> and misleading.
>

+1

Call it ASP. The use of "author domain" in the text will eliminate
confusion about the meaning of the "A".

	Wietse

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 12 Feb 2008 10:23:52 -0800

+1 sort of.

I agree that the term sender is misleading: it could correspond to a
mailing list. 

But author might also have somewhat loaded semantics. Are we looking for
something like 'originator'.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Arvel Hathcock
Sent: Tuesday, February 12, 2008 12:38 PM
To: DKIM WG
Subject: Re: [ietf-dkim] ISSUE: Rename SSP to ASP

 > As such, the name of the specification should reflect its precise
scope.  The  > current name of "Sender" Signing Practices is imprecise
and misleading.

Arvel

---

From: Jim Fenton <[email-masked]>
Date: Tue, 12 Feb 2008 10:35:54 -0800

Dave Crocker wrote:
> header field, which defines the author of a message.  It does not seek 
> to describe practices of other agents in email handling.
>

+1, but given that we have a WG draft called SSP and an individual draft 
called ASP which, I understand, is also under active revision I would 
not support this until the name change would not introduce confusion, 
i.e., when there is not active discussion about a draft of the same name 
as we would use.

-Jim

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 12 Feb 2008 19:56:59 +0100

Hallam-Baker, Phillip wrote:

> Are we looking for something like 'originator'.

No, that is were we came from, <originator> is a technical term
in 2822, and we could spend further years exploring its history
and subtle differences from a (2)821(bis) "originator", real or
imagined.

So far "something like" turned out to be "author".  Do you have
another idea, excluding "originator" and "sender" ?

 Frank

---

From: Eliot Lear <[email-masked]>
Date: Tue, 12 Feb 2008 20:02:06 +0100

Jim Fenton wrote:
> +1, but given that we have a WG draft called SSP and an individual 
> draft called ASP which, I understand, is also under active revision I 
> would not support this until the name change would not introduce 
> confusion, i.e., when there is not active discussion about a draft of 
> the same name as we would use.
>
> -Jim

+1.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Tue, 12 Feb 2008 20:03:14 +0100

please be advised that the issue tracker is currently down.  I don't yet 
have an ETR.

Eliot

---

From: Douglas Otis <[email-masked]>
Date: Tue, 12 Feb 2008 11:15:01 -0800

+1

This also overcomes Jim's concern over draft name confusion.   
Importantly this name ensures policy is at the domain and not at the  
author.

-Doug

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 12 Feb 2008 11:21:44 -0800

My problem here is that Phill Hallam-Baker is the Author of this email but verisign.com would be the signer.
 
I would be somewhat nervous about making the assertion that a domain is the author of a message. That might be exploited for purposes of legal mumbo-jumbo.

________________________________

From: [email-masked] on behalf of Frank Ellermann
Sent: Tue 12/02/2008 1:56 PM
To: [email-masked]
Subject: [ietf-dkim] Re: ISSUE: Rename SSP to ASP

 Frank

---

From: [email-masked] (Wietse Venema)
Date: Tue, 12 Feb 2008 15:05:21 -0500 (EST)

Hallam-Baker, Phillip:
[ Charset ISO-8859-1 unsupported, converting... ]
> My problem here is that Phill Hallam-Baker is the Author of this
> email but verisign.com would be the signer.
>  
> I would be somewhat nervous about making the assertion that a
> domain is the author of a message. That might be exploited for
> purposes of legal mumbo-jumbo.

Perhaps, Domain Signing Practices? DKIM / DSP fit together well.

	Wietse

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 12 Feb 2008 21:37:54 +0100

"Hallam-Baker, Phillip" <[email-masked]> schrieb [...]

Intro intentionally left as my MUA presents it in a reply.

> My problem here is that Phill Hallam-Baker is the Author
> of this email but verisign.com would be the signer.

Actually somebody using the address <[email-masked]>
is the purported author, and that person or entity picked
"Hallam-Baker, Phillip" as pretty name.  IMO versisign.com
could be in a position to judge whether they sign the mail.

At least they know that they have a user with the mailbox
"pbaker".  Maybe they don't know if the mail was submitted
by Phill Hallam-Baker, or by somebody else writing mails
in his name on a box permanently or temporarily attached
to their networks.  But DKIM clearly says that it is *not*
supposed to replace (or emulate) S/MIME and OpenPGP.  

The 2822 term <author> has the function to identify the
author(s), there is no guarantee that it is correct, and
DKIM also does not offer this guarantee.  SSP only allows
to reject any unsigned 2822-From: <[email-masked]> 
IFF the relevant verisign.com admin published a statement
that they always sign @verisign.com and consider unsigned
versions as broken or fakes.

That includes valid mails from the real Phill via another
ESP with Sender: <[email-masked]> and the SSP-protected
<[email-masked]>

It would be also the moment where I'd ask this relevant
admin if she's on crack or something, but depending on the
domain I might settle to use a Reply-To for my favourite
address with From: <[email-masked]>

Apparently this WG doesn't see the point in PRA and 2822,
now they use "author", neither "sender" nor PRA <shrug />
Let's see what happens...

> I would be somewhat nervous about making the assertion
> that a domain is the author of a message. That might be
> exploited for purposes of legal mumbo-jumbo.

The domain signs mails of authors using From-addresses in
this domain, and it is free to assert this "ASP", it does
not say that it "is the author".  Actually domains do not
"sign" or "say" anything, that is already an abstraction.

But "domain is the author" clearly make no sense.  IANAL,
if you are worried add an explanation to the "overview".

 Frank

---

From: Eliot Lear <[email-masked]>
Date: Tue, 12 Feb 2008 21:54:27 +0100

> but verisign.com would be the signer.

Good point.  Lop off an S?  SP?

Eliot

---

From: Douglas Otis <[email-masked]>
Date: Tue, 12 Feb 2008 14:10:09 -0800

> Perhaps, Domain Signing Practices? DKIM / DSP fit together well.

Looks good, but ADSP (Author Domain Signing Policy) specifies the  
policy is determined by the domain within the Author Address.  To make  
Frank happy, there could be a RDSP (Responsible Domain Signing Policy).

-Doug

---

From: "J D Falk" <[email-masked]>
Date: Tue, 12 Feb 2008 17:12:28 -0500

>> Dave Crocker wrote:
 [ . . . ]

+1

Since they're so similar, I'd think that changing the name as part of a
continued consensus-based[1] merger process might help to reduce that
confusion.

[1] (except for two extremely vocal particpants)

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 13 Feb 2008 01:20:41 +0100

Douglas Otis wrote:

> To make Frank happy, there could be a RDSP (Responsible Domain
> Signing Policy).

Is that about me ?  I don't care much about the acronym.  It
would be nice if somebody with an active en.wikipedia account
updates and "moves" the old "sender signing policy" article
to whatever the outcome is, ASP, ADSP, DSP, RDSP, or SP.  The
wikipedia concept of "move" automagically adds a redirect for
old links.  

 Frank

---

From: Douglas Otis <[email-masked]>
Date: Tue, 12 Feb 2008 17:50:57 -0800

On Feb 12, 2008, at 4:20 PM, Frank Ellermann wrote:

> Is that about me ?  I don't care much about the acronym.  It would  
> be nice if somebody with an active en.wikipedia account updates and  
> "moves" the old "sender signing policy" article to whatever the  
> outcome is, ASP, ADSP, DSP, RDSP, or SP.  The wikipedia concept of  
> "move" automagically adds a redirect for old links.

This is not to advocate for RDSP, although DKIM might evolve into  
employing different policies.  This is to advocate for ADSP, a name  
that could replace the non-specific Sender Signing Policy SSP.  You  
alluded that perhaps someone might use Purported Responsible Addresses  
when Author Addresses prove problematic.  One goal might be to  
establish a sensible convention that allows straight forward acronym  
changes.

Michael Hammer's suggested acronym of ADSP for Author Domain Signing  
Practices logically leads to Responsible Domain Signing Practices, for  
example.  This acronym clearly indicates the policy is governed by the  
Author's Domain and not that of the Author.  It is conceivable Author  
Policies could be published in a fashion similar to that devised for  
TPA-SSP records, where even the name of the two drafts might prove  
confusing.

ADSP is a less confusing acronym and resulting draft title, than the  
ASP suggested by that Dave Crocker and used by the ASP draft.  ASP is  
an acronym that collides with this different draft, precludes an  
Author specific policy, and denotes policy base upon the Author rather  
than the Author's domain.  Frank is right, ASP does not make sense.

Dave Crocker
Jim Fenton
Arvel Hathcock
JD Falk
Wietse Venema
-> ASP

Frank Ellermann
->ASP makes no sense, explain in overview

Michael Hammer
Douglas Otis
-> ADSP

Phillip Hallam-Backer
->~OSP

Eliot Lear
->hold-off due to draft name conflict
->SP

-Doug

---

From: John Levine <[email-masked]>
Date: 13 Feb 2008 04:15:34 -0000

>But author might also have somewhat loaded semantics. Are we looking
>for something like 'originator'.

Section 3.6.2 of RFC 2822 defines the Author(s) as the address(es) in
the From: line.  The same section is surprisingly vague about the
definition of sender; sometimes it's the address on the Sender: line,
sometimes it's the abstract entity responsible for dispatching the
message.  Originator is any or all of Sender:, From:, and Reply-To:.

Assuming we agree that SSP/ASP keys off the address(es) in the From:
line, and we want to avoid inventing yet more terminology, Author is
the best term of art we have.

R's,
John

---

From: Eliot Lear <[email-masked]>
Date: Wed, 13 Feb 2008 09:42:15 +0100

> continued consensus-based[1] merger process might help to reduce that

-1.  I don't want to comparison / contrast a potentially moving target.  
It seems easier at this point just to open issues on -SSP-02.  Otherwise 
we're going to take forever to get this work done.

Eliot

---

From: Jim Fenton <[email-masked]>
Date: Wed, 13 Feb 2008 10:22:40 -0800

I note that the issue tracker is back, and I see the following 
recently-added issues:

1546: Discardable inappropriately specifies possible verifier action (Otis)
1547: MX Record publishing mandate to reduce DNS overhead for SSP 
Discovery and to detect fraudulent messages (Otis)
1548: Policies Required to close security threats (Santos)
1549: Security Threats are [not] well defined (Santos)
1550: Rename SSP to ASP (Crocker)

Thanks, Eliot!

-Jim

Eliot Lear wrote:
> please be advised that the issue tracker is currently down.  I don't 
> yet have an ETR.
>
> Eliot
>

---

From: Eliot Lear <[email-masked]>
Date: Thu, 14 Feb 2008 11:56:10 +0100

> please be advised that the issue tracker is currently down.  I don't 

The issue tracker is indeed back up.  I, however, will be offline until 
Saturday.  Expect more issues to be opened then.  Thanks to Randy Bush 
for prompt response and assistance.

Eliot