Subject: [EAI] Conclusion from Prague: Relation of UTF8SMTP gateways to DKIM

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 22 Mar 2007 15:59:30 +0100

After discussing the matter in Prague, and receiving advice from people 
closely involved with the DKIM WG, the consensus of the WG room was that it 
was NOT a design goal for downgrading to make it possible to reverse-map 
("upgrade") the result in such a way as to make verification of digital 
signatures over the headers possible.

To be precise: When presented the following alternatives:

2 - Upgrade is needed in a recipient system, for display, reply and for 
checking signatures.

3 - Upgrade is needed in a recipient system, for display and reply only.

the count in the room was approximately 20 for option 3 and 1 for option 2.

As with all meeting consensus calls, this needs to be verified on the 
mailing list. Consider this the opening of a call for comments on the 
resolution.

                 Harald, for the chairs

_______________________________________________
IMA mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ima

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 23 Mar 2007 20:02:07 -0000

On Thu, 22 Mar 2007 14:59:30 -0000, Harald Tveit Alvestrand  
<[email-masked]> wrote:

> closely involved with the DKIM WG, the consensus of the WG room was that  
> it was NOT a design goal for downgrading to make it possible to  
> reverse-map ("upgrade") the result in such a way as to make verification  
> of digital signatures over the headers possible.

Whilst it is not a design goal that upgrading should exactly reverse the  
downgrading process, it would still be a useful property if it turned out  
to be achievable, so we should not invent features that would prevent it  
 from working without careful thought.

In fact, it is unlikely to work to 100% perfection, but it might well work  
often enough to be useful, and it can probably be made to work 100% modulo  
some normalization/canonicalization process (that would, for example,  
ignore differences of folding, and prably other other differences too). So  
if all that was required to make DKIM work on downgraded messages was a  
special DKIM canonicalization method (DKIM is designed to allow new  
canonicalization methods in future), then that would be a satisfactory  
outcome.
> 3 - Upgrade is needed in a recipient system, for display and reply only.

So I think my answer would be

   2½ - Upgrade in conjunction with special camonicalization features, and  
maybe some other restrictions, might well provide a viable DKIM signature  
checking mechanism.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5