Subject: Re: [ietf-dkim] Lists "BCP" draft available

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 25 Jul 2010 02:36:11 -0700

Going back through a few months of mail on the flight to IETF, preparing to post an update to this draft...

The intent of that paragraph is actually not to encourage use of "l=", but rather just to include it in the discussion.  An MLM designer will probably want to try "l=" to solve this problem but may not be aware of the implications of its use, so it just points the reader back to the warning about it in RFC4871.

For non-MIME mail, though, isn't a basic text append the way to do it?

From: Serge Aumont [mailto:[email-masked]]
Sent: Tuesday, May 11, 2010 7:38 AM
To: Murray S. Kucherawy
Cc: [email-masked]
Subject: Re: [ietf-dkim] Lists "BCP" draft available

[...]
Section 3.4
At last, another idea usefulness is that draft in   :
"A possible mitigation to this incompatibility is use of the "l=" tag to bound the portion of the body covered by the body hash, but this has security considerations (see Section 3.5 of [DKIM])."

The "l=" tag is one of the worth idea of DKIM if introduced because of message body footer added by some MLM. MLM must not add anything after the end of a message because this break Mime content. When adding a footer, MLM should add an extra mime part, and this often require to modify mime headers. So "l=" tag should not ne considered as an efficient way to protect DKIM signature.

I known that the problem is comming from rfc-4871 but I  propose to remove this sentence from this draft.

Serge Aumont

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 25 Jul 2010 15:11:35 -0000

>For non-MIME mail, though, isn't a basic text append the way to do it?

I suppose, although it is my impression that in non-nerd circles, the
amount of non-MIME mail is too small to be worth worrying about.

FWIW, I've seen list software edit a footer into the HTML code of a
message.  Ain't no way a signature can survive that, so the reasonable
approach is, as always, for the list to sign and recipients to key on
the list's signature.

R's,
John