Subject: [ietf-dkim] Interesting Dupe Signatures

From: hector <[email-masked]>
Date: Sat, 31 Oct 2009 13:45:04 -0400

Working on a DKIM stats log analyzer, I found some facebookmail.com 
notification messages with two duplicate DKIM signatures.

DKIM-Signature: v=1; a=rsa-sha1; d=facebookmail.com; s=q1-2009b;
         c=relaxed/relaxed;
	q=dns/txt; i=@facebookmail.com; t=1256981485;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=uFmzuYhiBd82ctm8i9mPRevatL4=;
   b=m4nhlG7A0JxZnEWa6DQza0oMghkv6CI+vNM41hY7tipGHfvj6EXCpXaFFGuV/xgj
	Zut8syylO1s4qASiqCWBaQ==;
DKIM-Signature: v=1; a=rsa-sha1; d=facebookmail.com; s=q1-2009b;
         c=relaxed/relaxed;
	q=dns/txt; i=@facebookmail.com; t=1256981485;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=uFmzuYhiBd82ctm8i9mPRevatL4=;
   b=m4nhlG7A0JxZnEWa6DQza0oMghkv6CI+vNM41hY7tipGHfvj6EXCpXaFFGuV/xgj
	Zut8syylO1s4qASiqCWBaQ==;

I don't see a difference.

I'm sure this is probably minor, but with "tons" of fb notifications 
coming into users machines, short circuiting redundant hash 
verification probably has some merit.

How should it be handled?  Should logic be added to see if the bh= or 
b= base64 hash was already processed?

Is this something that should be reported to Facebook?

--
HLS

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Steve Atkins <[email-masked]>
Date: Sat, 31 Oct 2009 10:55:32 -0700

> b= base64 hash was already processed?

I'd expect that shortcircuiting the bh= calculation would save a lot
of work in the more typical case that the two signatures are by
different signers, so is worth doing.

Cheers,
   Steve

---

From: Michael Thomas <[email-masked]>
Date: Sat, 31 Oct 2009 11:25:16 -0700

Is this really worth worrying about? I mean, the amount of actual ham is in
the vast minority so even if all of your ham was doing tons of anti social
things it probably wouldn't make much if any difference in your average border
mail gateway's job.

Mike

---

From: hector <[email-masked]>
Date: Sat, 31 Oct 2009 14:57:18 -0400

Michael Thomas wrote:

 > Is this really worth worrying about? I mean, the amount of
 > actual ham is in the vast minority so even if all of your ham
 > was doing tons of anti social things it probably wouldn't make
 > much if any difference in your average border mail gateway's job.

Possibly mike. I certainly do not wish to do more work than necessary.

But I have to consider customer sites patterns with heavy facebook 
users seeing tons of fb notifications and see if a simple check can 
add to the optimization.

Before that though, I need to see if this can be confirm by others. 
Checking yesterday's logs and collection of dkim messages, I see 
intermittent FB dupe signature messages and I just found one with 4 
duplicate signatures:

   DKIM-Signature: v=1; a=rsa-sha1; d=facebookmail.com; s=q1-2009b;
         c=relaxed/relaxed;
	q=dns/txt; i=@facebookmail.com; t=1256955289;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=Qfz3NWckqB6n8R6eXuamGE/bU/k=;
         b=gwjR3fg8RpRr6X2TvywoXBSiP2niRsyCoKBsnW0yaNxkJk4t
         87dWx8H/rXEN54O6jHf+Uf9mG4Tth7ZcoNY+GA==;

times 4.

So although its the only header exhibiting dupes and I don't see this 
behavior with other DKIM signers, I am still going to give FB the 
benefit of the doubt and check if this FB signature is somehow raising 
a hidden reception bug in our code. Off hand I doubt it since our code 
is using DATA 8k buffer read/write to a temp file. i.e, its not 
reading per line in the DATA block but FB might be sending it per 
line.  I have to see whats going on there.

Be great if someone else with incoming fb notifications can confirm 
this intermittent behavior. If its a FB issue, then probably there is 
no need to bother.  But Steve did raise an interesting point with two 
(or more) different signers (perhaps blindly) stamping the same 
message content.  Resigners really shouldn't be doing that unless they 
are going to break the integrity, right?

---

From: hector <[email-masked]>
Date: Sat, 31 Oct 2009 15:58:59 -0400

hector wrote:

> But I have to consider customer sites patterns with heavy facebook users 
> seeing tons of fb notifications and see if a simple check can add to the 
> optimization.
> 
> benefit of the doubt and check if this FB signature is somehow raising a 
> hidden reception bug in our code. Off hand I doubt it since our code is 
> using DATA 8k buffer read/write to a temp file. i.e, its not reading per 
> line in the DATA block but FB might be sending it per line.  I have to 
> see whats going on there.

This is a FB bug. I found a few dupe signatures in my gmail.com DKIM 
inbox messages.