Subject: Re: [ietf-dkim] NO DKIM "POLICY"

From: Franck Martin <[email-masked]>
Date: Sat, 21 Feb 2009 14:37:44 +1200 (ANAT)

I see a problem with I allow 3rd party signers. In the case of a mailing list or forwarder or remailer, it may sign without the knowledge of the original sender which is acceptable. 

----- Original Message ----- 
From: "Hector Santos" <[email-masked]> 
To: "Franck Martin" <[email-masked]> 
Cc: "Douglas Otis" <[email-masked]>, [email-masked] 
Sent: Saturday, 21 February, 2009 11:59:28 AM (GMT+1200) Auto-Detected 
Subject: Re: [ietf-dkim] NO DKIM "POLICY" 

Franck Martin wrote: 
> Any way to tell someone its signature is used in third party signing? 

AFAIK, not in a standard fashion 

As Doug pointed out, you can detect that it appears to be 3rd party, 
but the long debated issue has been how to determine if the 
3rd party was "authorized" to sign for the 1st party domain (Author 
Domain, From:) 

This was the original DKIM idea - to include POLICY ideas like this. 

DKIM was then separated as DKIM-BASE and SSP. SSP had policies like: 

I don't send mail 
I always sign 
I sometimes sign 
I allow 3rd party signers. 

I have a good diagram that illustrates the logic flow when SSP policy 
was considered: 

http://www.winserver.com/public/ssp-old/ssp.htm 

In short, verifiers could do policy DNS lookup and check the "o=" tag: 

o=. NEVER (no mail expected) 
o=? WEAK (signature optional, no third party) 
o=~ NEUTRAL (signature optional, 3rd aparty allowed) 
o=- STRONG (signature required, 3rd party allowed) 
o=! EXCLUSIVE (signature required, no 3rd party) 
o=^ USER 

If it was o=? or o=!, then that means no 3rd parties signing was 
expecting. If it was o=~ or o=-, then 3rd party was allowed, etc. 

But unfortunately, the January 2008 blockbuster shock of the year, out 
of the blue, SSP was stripped down to what we have today ADSP which 
for the most part only has: 

dkim=unknown The domain might sign some or all email. 
dkim=all I always sign, only me. "Don't delete?" 
dkim=discardable same as all "but you can delete?" 

Maybe someone can confirm that, but I'm sure sure that is basically 
all it offers. 

To answer your question - not possible. 

The topic here "NO DKIM" was trying to redeem something of the based 
spec hopefully, the NULL PUBLIC KEY and that idea came from the author 
of DKIM. A customer of ours got noticed from one of their vendors 
about DKIM signing and wanted to know what can they do to isolate it. 

-- 
Sincerely 

Hector Santos 
http://www.santronics.com 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Sat, 21 Feb 2009 05:19:18 -0500

Franck Martin wrote:
> I see a problem with I allow 3rd party signers. In the case of 
 > a mailing list or forwarder or remailer, it may sign without the
 > knowledge of the original sender which is acceptable.

I just noticed this mailing list is signing as a 3d party:

     From: Hector Santos <[email-masked]>
     DKIM-Signature: d=mipassoc.org;

In all honesty I am not sure I like this.  I have to check to see if 
the mail is verified or the hash integrity is broken.  How is the MLS 
signing the subject line, the original or one with the [IETF-DKIM] 
prepended?

On a related note, when SSP was active, I had proposed for Mailing 
List Server (MLS) the following logic, something I considered for our 
own MLS product as well for DKIM support:

    Subscription Controls

    MLS subscription processes should perform a SSP check to
    determine if a subscribing email domain SSP policy is
    restrictive in regards to mail integrity changes or
    3rd party signatures. The MLS SHOULD only allow original
    domain policies who allow 3rd party signatures.

Reading the ADSP draft....

    http://tools.ietf.org/html/draft-ietf-dkim-ssp-09

I see if  I add a ADSP record for santronics.com

   dkim=all or
   dkim=discardable

then for protocol consistency, the mipassoc.org MLS who now supports 
DKIM signing, should also consider ADSP and lookup the domain to see 
if the DOMAIN is allowing 3rd party signatures.  At the very least, it 
should do this at the subscription process.

I think I am going to unsubscribe and subscribe under another domain.

-- 
Sincerely

Hector Santos