Subject: [ietf-dkim] More formal definition of 3rd-party signatures?

From: Jeff Macdonald <[email-masked]>
Date: Wed, 17 Mar 2010 13:36:01 -0400

I found this from RFC 5016:

   o  First Party Address: for DKIM, a first party address is defined to
      be the [RFC2822].From address in the message header; a first party
      address is also known as an Author address.

   o  First Party Signature: a first party signature is a valid
      signature where the signing identity (the d= tag or the more
      specific identity i= tag) matches the first party address.
      "Matches" in this context is defined in [RFC4871].

   o  Third Party Signature: a third party signature is a valid
      signature that does not qualify as a first party signature.  Note
      that a DKIM third party signature is not required to correspond to
      a header field address such as the contents of Sender or List-Id,
      etc.

I thought the ADSP draft had such a definition, but it doesn't seem
to. This draft talks about i=, which if I recall correctly, can be
include sub-domains of d=. Since i= is no longer seen as an identity,
then I believe we need a more formal definition of a third-party
signature.

If "or the more specific identity i= tag" was removed from the above
definition, would everyone agree that is the proper definition of a
third-party signature? That would mean:

From: [email-masked]
DKIM-Signature: ... d=i.example.com

would be considered a third-party signature.

--
Jeff Macdonald
Ayer, MA

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Wed, 17 Mar 2010 11:03:05 -0700

> would be considered a third-party signature.
d=bar.example.com is unable to add a valid "author domain" signature for 
[email-masked].   There would be no hierarchical authority permitted, 
otherwise.  See section 2.7 of RFC 5617.

One might want to equate Author Domain signatures with "first party" 
signatures, and all others as "third party".

Even d=example.com is unable to add a valid "author domain" signature 
for [email-masked].  It does not seem logical to describe 
signatures as third-party when higher within the hierarchy than the 
author domain.

2.7.  Author Domain Signature

An "Author Domain Signature" is a Valid Signature in which the domain
name of the DKIM signing entity, i.e., the d= tag in the DKIM-
Signature header field, is the _same_ as the domain name in the Author
Address.  Following [RFC5321], domain name comparisons are case
insensitive.

  -Doug