On Sun, Nov 20, 2022 at 11:08 AM Dave Crocker <[email protected]> wrote:
> On 11/11/2022 7:19 AM, Murray S. Kucherawy wrote: > > I think you've hit on possibly the most interesting part of this: In > > RFC 6376, we said "You're taking some responsibility for this > > message... and oh, by the way, it could get replayed, and your claimed > > responsibility extends to that case as well". I don't know that we > > underscored the latter very much then or since. > > At the time DKIM was first developed, we knew that replay was possible. > It was deemed a lesser concern. Back then. > > But the "by the way" that you've added was /not/ part of the thinking > then and it occurs to me that a) no it was not and is not intended, and > b) this might argue for *having MDAs remove DKIM signatures...* > As I read RFC 6376, we knew that relay was possible, and we said up front the bit about "some responsibility". We didn't take the stand at any point that a replay absolved the signer of that (admittedly nebulous) responsibility; indeed, there's no obvious way for a verifier to be able to tell that the message was [not] replayed so as to give it different treatment. In fact, not knowing where the message is ultimately going, what its content means, or how it will be consumed, is what compelled us to make the responsibility nebulous in the first place. Of course, that was 2011, and kind of a lot's happened since then. -MSK
_______________________________________________ Ietf-dkim mailing list [email protected] https://www.ietf.org/mailman/listinfo/ietf-dkim
