Subject: [ietf-dkim] NEW ISSUE: Policies Required to close security threats

From: Hector Santos <[email-masked]>
Date: Mon, 11 Feb 2008 20:06:42 -0500

I recommend the following changes/new text for section 3.3. SSP Record 
Syntax:

3.3.  SSP Record Syntax

  SSP Records MUST match the "tag-list" syntax defined in [RFC4871].
  The specific tags used in SSP records are described below.
  Unrecognized tags MUST be ignored.

  dkim=  Outbound signing practices for the domain (plain-text;
         REQUIRED).  Possible values are as follows:

     unknown

        Any domain may sign none, some, or all email.

        The lack of a SSP record signifies an unknown policy which
        allows any domain to sign mail on behalf of the Author domain.

        There is no DKIM protocol consistency check for this
        unknown policy.

     optional

        Only the Author Domain may sign none, some, or all email.

        This policy is different from the default dkim=unknown policy
        which allows for any domain to sign. The dkim=optional
        policy is an optional Author Domain only signing practice.

        The existence of a 3rd party signature contradicts the DKIM
        protocol consistency of this explicit domain policy and
        therefore the message SHOULD be rejected without prejudice.

     all

        All mail from the domain is signed by any domain.

        A no signature message contradicts the DKIM protocol
        consistency of this explicit domain policy and therefore the
        message SHOULD be rejected without prejudice.

     Discardable

        All mail from the domain is signed with an Author Signature.
        Furthermore, if a message arrives without a valid Author
        Signature due to modification in transit, submission via a path
        without access to a signing key, or other reason, the verifier
        MUST reject the message without prejudice.

-- 
Sincerely

Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Charles Lindsey" <[email-masked]>
Date: Tue, 12 Feb 2008 11:05:23 -0000

>         Only the Author Domain may sign none, some, or all email.

No Way!

Signers and SSP publishers CANNOT dictate who else may or may not add  
signatures as the message propagates further. It is just not the business  
of SSP to state that. List expanders, for example, can be expected to add  
their signatures as a matter of routine.

If what you are trying to say is what signers to whom you have outsourced  
your mail sending may or may not do (which is one - but only one - meaning  
of "3rd party signing"), then that is fine, but that is NOT what you have  
written

What SSP CAN do is to state how subsequent signatures are to be handled by  
checkers/evaluators/verifiers/whatever.

For example, the true effect of the "Discardable" option is to tell  
verifiers that "we recommend you to ignore any signatures other that our  
own when deciding how to dispose of these messages". In fact, the  
semantics of "Discardable" should probably be specified in that way.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html