Subject: Re: [ietf-dkim] Broken signature analysis

From: Dave CROCKER <[email-masked]>
Date: Mon, 01 Mar 2010 22:28:04 +0800

On 2/27/2010 10:54 PM, John Levine wrote:
>> Doesn't that conflict with the practice of removing A-Rs?
>
> You only need to remove A-Rs that claim to be from you.

That's a claim worth challenging.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Ian Eiloart <[email-masked]>
Date: Mon, 01 Mar 2010 17:34:23 +0000

> That's a claim worth challenging.

It's two claims, actually:

1. You need to remove A-R's that claim to be from you.
2. You don't need to remove A-R's that don't claim to be from you.

Unless the second claim is "You don't need to do anything else with A-R's 
that claim to be from you" I doubt that's the case, though.

Anyway, which claim would you challenge? Oh, maybe the claim referred to in 
the claim!

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 02 Mar 2010 09:25:15 +0800

> Anyway, which claim would you challenge? Oh, maybe the claim referred to in

the second.

d/

-- 

   Dave Crocker

---

From: John Levine <[email-masked]>
Date: 2 Mar 2010 04:42:12 -0000

>That's a claim worth challenging.

Well, that's what section 5 of RFC 5451 says.  If you think it's
wrong, why didn't you say so back when there was time to change it?

R's,
John

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 02 Mar 2010 12:48:23 +0800

> wrong, why didn't you say so back when there was time to change it?

You might consider re-reading the second paragraph of that section.

The question I am raising distinguishes between the mathematical purity of the 
MUST requirement, versus the pragmatic benefit of the MAY.

d/

-- 

   Dave Crocker

---

From: "Charles Lindsey" <[email-masked]>
Date: Tue, 02 Mar 2010 11:29:12 -0000

> 2. You don't need to remove A-R's that don't claim to be from you.

More precisely, I think, you need to remove A-R's that claim to be from  
you but that you know to be bogus.

It if genuinely was from you (possibly unlikely, but perhaps some  
complicated expansion of your own message to multiple lists which all just  
happened to occur on your own machine (possibly even breaking the earlier  
signature at each stage), then it is probably better to leave it.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 2 Mar 2010 18:13:13 -0000

>you but that you know to be bogus. ...

Sections 5 and 7 of RFC 5451 go through a bunch of different
scenarios.  The summary of what they say is 1. and 2. above, but it
goes into issues of broken signatures and other possible problems.

R's,
John