Subject: [ietf-dkim] draft-ietf-dkim-ssp, "Author Signatures" and "i=" tag

From: "[email-masked]" <[email-masked]>
Date: Wed, 17 Dec 2008 14:20:18 +0200

(Continuing from my previous email):	 

The terms "Valid Signature from an Author Domain" and "Author
Signature" are very easily confused. If I understood Doug's comments
right, he's essentially proposing making these two terms identical. 
That would certainly simplify things, but since the WG has decided 
otherwise, we need to make sure the distinction is understood
by the reader. 

Going over places that may need some clarification:

Section 1 should probably explicitly say that while RFC 4871 does not
require the value of the "i=" tag to match the identity in any message
header fields, this document can express a signing practice that
requires it to match as described in Section 2.7.  Using this signing
practice prevents the use of the "i=" tag for other purposes (such as
expressing what the signer actually authenticated) in the future.

Section 3.2:
>   o If a message has a Valid Signature from an Author Domain, ADSP
>     provides no benefit relative to that domain since the message is
>     already known to be compliant with any possible ADSP for that
>     domain.

"If a message has an Author Signature, ..."?

Section 3.2:
>   o  If a message has a Valid Signature from a domain other than an
>      Author Domain, the receiver can use both the Signature and the
>      ADSP result in its evaluation of the message.

"If a message has a Valid Signature that from a domain other than an
Author Domain, or a Valid Signature from an Author Domain that does
not meet the requirements of Author Signature, .."?

Section 3.3:
>   o  Messages from this domain might or might not have an author
>      signature.  This is the default if the domain exists in the DNS
>      but no ADSP record is found.

While technically this is true, "might or might not have an Author
Signature (and might or might not have other Valid Signatures that
are not Author Signatures)" would make the distinction clearer.

Section 3.3:
>   o  All messages from this domain are signed.

"All messages from this domain are signed with Author Signatures"

Appendix B should briefly discuss cases where an organization signs
(takes responsibility using Valid Signatures) for all its outgoing
mail, but not always with Author Signatures (so it can't advertise
dkim=all/dkim=discardable policy).  At least the following
cases some to mind:

- "Sender": For example, if John's secretary Michael sends a message
(based on [RFC5322], Appendix A.1.1), and the "i=" tag identifies the
authenticated submitter of this message (Michael), the signature is
not an Author Signature:

   From: John Doe <[email-masked]>
   Sender: Michael Jones <[email-masked]>
   DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=brisbane;
         q=dns/txt; i=[email-masked]; [...]

- Subdomains: The following signature is not an Author Signature,
because the domain taking responsibility for the email ("example.com")
is not equal to the Author Domain ("eng.example.com").

   From: John Doe <[email-masked]>
   DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=brisbane;
         q=dns/txt; [...]

If an "i=" tag with value "@eng.example.com" is added, the signature
becomes an Author Signature:

   From: John Doe <[email-masked]>
   DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=brisbane;
         q=dns/txt; i=@eng.example.com; [...]

- Mailing lists: A mailing list exploder that takes responsibility for
messages on the list does not usually add Author Signatures.  For
example, a mailing list exploder for a public mailing list
"[email-masked]" might add the following signature:

   From: [email-masked]
   To: [email-masked]
   Sender: [email-masked]
   DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=brisbane;
         q=dns/txt; i=[email-masked] [...]

The message could, however, contain also an Author Signature, probably
added before the message reaches the mailing list exploder. If Author
Signatures are added by Boundary MTAs, this requires defining the
boundaries correctly.

Comments, thoughts?

Best regards,
Pasi

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jeff Macdonald <[email-masked]>
Date: Wed, 17 Dec 2008 10:48:48 -0500

>"If a message has an Author Signature, ..."?

It would still need to be valid unless it is clear in the document that
all Author Signatures are valid. Seems to be safer to specify "valid"
to me...

>not meet the requirements of Author Signature, .."?

I apologize for not re-reading all of the ADSP document, but I think we
have to remember that a message can have multiple DKIM signatures.
Perhaps that is what section 3.2 is trying to address?

-- 
Jeff Macdonald
[email-masked]

---

From: Byung-Hee HWANG <[email-masked]>
Date: Thu, 18 Dec 2008 07:08:50 +0900

[email-masked] wrote:
[...]
>    DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=brisbane;
[...]

A long time ago, i have *also* thought about this matter - Subdomains 
and "i=" tag. Actually that should be clear ;;

byunghee