Subject: [ietf-dkim] New Issue: overview document does not mention message validity

From: "J D Falk" <[email-masked]>
Date: Tue, 18 Mar 2008 19:30:09 -0400

Suggested addition to section 2, though I'm not entirely certain that
"validity" is the correct word to use here:

2.3.  Establishing Message Validity

   Though man-in-the-middle attacks are historically rare in email,
   it is nevertheless theoretically possible for a message to be
   modified during transit.  An interesting side effect of the
   cryptographic method used by DKIM is that it is possible to be
   certain that a signed message (or, if l= is used, the signed
   portion of a message) has not been modified.  If it has been
   changed in any way, then the message will not be verified
   successfully with DKIM.

   As described above, this validity neither lowers nor raises the
   level of trust associated with the message.  If it was an
   untrustworthy message when initially sent, the verifier may be 
   certain that the message will be equally untrustworthy upon 
   receipt and successful verification.

--
J.D. Falk
Receiver Products
Return Path 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Tue, 18 Mar 2008 20:54:00 -0700

Hmmm.

1.  Abstract and 1. Intro cite data integrity.  Does there need to be more 
detail explaining that cryptographic authentication provides data integrity too?

1.  1.1 Scope lists things DKIM does not deal with, including a replay attack. 
Does the text really need more discussion than that?

Here's core question with this sort of overview:  It can include too much 
tutorial about basic technology, rather than focusing on the specifics of the 
technology it is meant to describe.  Some pedagogy is needed, but how much?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "J D Falk" <[email-masked]>
Date: Wed, 19 Mar 2008 14:13:03 -0400

> Here's core question with this sort of overview:  It can include too
> much tutorial about basic technology, rather than focusing on the
> specifics of the technology it is meant to describe.  Some pedagogy is
> needed, but how much?

I've been noticing that data integrity (much better term, thanks) is
often forgotten when discussing DKIM, yet it's clearly very important to
some senders.  Section 2 is basically "what will DKIM do for me?" -- so
I think it should be included there.

---

From: Dave Crocker <[email-masked]>
Date: Wed, 19 Mar 2008 17:00:14 -0700

> I think it should be included there.

point taken.

does anyone object to the proposed change?

d/

-- 

   Dave Crocker

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Wed, 19 Mar 2008 20:36:06 -0400

No objections here.

Mike

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Dave Crocker
Sent: Wednesday, March 19, 2008 8:00 PM
To: J D Falk
Cc: [email-masked]
Subject: Re: [ietf-dkim] New Issue: overview document does not mention
message validity

point taken.

d/

-- 

   Dave Crocker

---

From: "Al Iverson" <[email-masked]>
Date: Wed, 19 Mar 2008 21:22:54 -0500

None here, either.

Al

-- 
Al Iverson on Spam and Deliverability, see http://www.spamresource.com
News, stats, info, and commentary on blacklists: http://www.dnsbl.com
My personal website: http://www.aliverson.com   --   Chicago, IL, USA
Remove "lists" from my email address to reach me faster and directly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Siegel, Ellen" <[email-masked]>
Date: Thu, 20 Mar 2008 10:34:28 -0400

No objection, I think the point is well taken. 

Ellen

> From: [email-masked] [mailto:ietf-dkim-
> [email-masked]] On Behalf Of Dave Crocker