Subject: Re: [ietf-dkim] NEW ISSUE: SSP-02: Policy Scope

From: Douglas Otis <[email-masked]>
Date: Thu, 14 Feb 2008 11:40:54 -0800

The prior syntax did not seem to permit enough flexibility.

s= Policy Scope (plain-text; OPTIONAL; default is "*").  A colon-
   separated list of policy scopes specify which protocols to which
   this record applies.  Verifiers for a given service type MUST
   ignore this record if the appropriate type is not listed.
   Currently defined protocol types are as follows:

       *  matches all unlisted service types
       !  disavows protocol use
       -  excludes from policy

       SMTP	RFC2821
       NNTP	RFC3977
       MSRP	RFC4975
       UUCP	RFC976

   This tag is intended to constrain the use of policy for various
   transport protocols that may implement, should DKIM be defined by
   other protocols in the future. This tag can also disavow use
   of specific protocols to repudiate references to this domain.

   As example, "s=SMTP:-UUCP:!*" would mean this domain only uses
   SMTP and UUCP to exchange messages, but that this policy does not
   apply to UUCP.

ABNF:

   policy-s-tag  = %x73 [FWS] "=" [FWS][exclude|disavow] policy-s-tag- 
type
                   0*( [FWS] ":" [FWS] policy-s-tag-type )
   disavow = "!"
   exclude = "-"
   policy-s-tag-type   = "SMTP" /
                         "NNTP" /
                         "MSRP" /
                          UUCP /
                         "*" /
                         x-policy-s-tag-type
   x-policy-s-tag-type = hyphenated-word   ; for future extension
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Frank Ellermann" <[email-masked]>
Date: Fri, 15 Feb 2008 01:01:00 +0100

> UUCP RFC976

Did you understand what I meant when I mentioned gateways ?

> SMTP and UUCP to exchange messages, but that this policy does
> not apply to UUCP.

For a verifier at an MTA it is irrelevant how the message might
have started, if it arrives as "mail" (likely SMTP) it is "mail",
and a From header field is a From header field without studying
the fine print in RFC 4356, RFC.usefor-usefor, RFC 976, etc.

RFC 976 has status "unknown", this means MAJOR TROUBLE.  I just
read John's appeal against the first RFC 4356 attempt again, it
was a disaster... <shudder />

> policy-s-tag  = 
>      %x73 [FWS] "=" [FWS][exclude|disavow] policy-s-tag-type

No more [FWS] in SSP-02. it's now *WSP.  It's now clear that
net-utf8 sticks to "disavow" HT, maybe SSP-03 should say *SP.

 Frank

---

From: Douglas Otis <[email-masked]>
Date: Thu, 14 Feb 2008 17:29:22 -0800

> Did you understand what I meant when I mentioned gateways ?

While this may not be a good initial list for transport protocols,   
this was to illustrate more than one "public" transport is affected.   
It would be incorrect to assume that a DKIM policy assertion applies  
to all such transports.  A receiver may not aggregate messages from  
all transports into mailboxes primarily served by SMTP.  Regardless of  
the transport, DKIM might be used nonetheless.  When a transmitting  
domain has not implemented DKIM for a specific transport protocol,  
then an assertion that "all" messages have been signed needs to  
reflect where this has been implemented.  Receivers will need to  
decide whether they wish to merge the messages from one transport into  
a mailbox served by SMTP.  When the transport has been modified by an  
up stream third-party, then receivers down stream are likely to apply  
the policy pertinent to current transport.  The syntax of the policy  
record affords enough flexibility for the transmitter to express how  
they wish to see policy applied.

>> As example, "s=SMTP:-UUCP:!*" would mean this domain only uses SMTP  
>> and UUCP to exchange messages, but that this policy does not apply  
>> to UUCP.
>
> For a verifier at an MTA it is irrelevant how the message might have  
> started, if it arrives as "mail" (likely SMTP) it is "mail", and a  
> From header field is a From header field without studying the fine  
> print in RFC 4356, RFC.usefor-usefor, RFC 976, etc.
>
> RFC 976 has status "unknown", this means MAJOR TROUBLE.  I just read  
> John's appeal against the first RFC 4356 attempt again, it was a  
> disaster... <shudder />

Thanks for the input.  It would seem this should be moved to an IANA  
controlled protocol list.

> No more [FWS] in SSP-02. it's now *WSP.  It's now clear that net- 
> utf8 sticks to "disavow" HT, maybe SSP-03 should say *SP.

Sorry about that, was doing a quick cut and paste from the RFC 4871.

Take #3.

s= Policy Scope (plain-text; OPTIONAL; default is "*").  A colon-
  separated list of policy scopes specify which protocols to which
  this policy record applies.  Verifiers for a given protocol MUST
  ignore this record when the appropriate protocol has not been
  listed.  Currently defined protocol types are as follows:

      *  matches against all unlisted transport protocols
      !  disavows protocol use
      -  excludes protocol from policy assertions

      SMTP	RFC2821
      NNTP	RFC3977
      See IANA SSP Policy List for additional protocols.

  This tag is able to tailor the application of policy against
  various transport protocols which may now or in the future
  implement DKIM.  This tag can also disavow use of specific
  protocols to repudiate references to the domain.

  A gateway that converts protocols ahead of the receiver may
  change the policy applied.  When uniform policy is desired for
  all possible transports no tag is necessary, as the default is
  "s=*".  When a receiver combines messages from various
  transports, it is RECOMMENDED the policy pertaining to the
  primary transport protocol be applied.  In most cases, this
  policy would be for SMTP.

  As example, "s=SMTP:-NNTP:!*" would mean this domain only uses
  SMTP and NNTP to exchange messages, but that this policy does
  not apply against NNTP.  When a protocol has been disavowed,
  any further DKIM related transactions should cease.

ABNF:

  policy-s-tag  = %x73 [WSP] "=" [WSP][exclude|disavow] policy-s-tag- 
type
                  0*( [WSP] ":" [WSP] policy-s-tag-type )
  disavow = "!"
  exclude = "-"
  policy-s-tag-type   = "SMTP" /
                        "NNTP" /
                        "*" /
                        x-policy-s-tag-type
  x-policy-s-tag-type = hyphenated-word   ; for future extension

-Doug