[Ietf-dkim] Re: New Version Notification for draft-nurpmeso-dkim-access-control-diff-changes-06.txt

[Steffen Nurpmeso]

Hm, sorry people..

Steffen Nurpmeso wrote in
 <20250708010154.3qxReRwY@steffen%sdaoden.eu>:
 |aah, sigh.. surely you see it then..

i expanded on that locally, with some further changes (lots of
typo fixes, cruft DKIMACDC->ACDC, DKIM-Diff:->DKIM-DC:, shorter
tags).  Also because the sent examples missed the Y and y flags,
which are permanent (Sigmund Freud surely would have his fun) ...

So here that example, fixed (Yy), and extended with more
recipients, also which will fail SPF and DMARC without
Mitigations'25, and one second-line recipient.

  Originator (yet forged for recipient domain f.g):

    MAIL FROM: <a@b.c>
    RCPT TO: <d@f.g>
    RCPT TO: <e@f.g>
    ...
    DKIM-AC: sn=1; s=K1; f=a@b.c; d=f.g; t=d; t=e; b=...
    DKIM-Signature: acdc=1:O; s=K1; ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a@b.c
    To: d@f.g, e@f.g, x@y.z, u@v.w, r@s.t, o@p.q

    bla

  f.g, local delivery:

    ...
    DKIM-Signature: acdc=2:IV; ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a@b.c
    ...

  x@y.z -- a mailing-list!
  It redistributes after RFC 2369 and RFC 2919 additions,
  in-message unsubscribe footer, and From: mitigated
  (in best RFC 3461 manner):

    MAIL FROM: <x@y.z>
    RCPT TO: <l@m.n>
    ...
    DKIM-AC: sn=2; s=K2; f=x@y.z; d=m.n; t=l; b=...
    DKIM-DC: sn=2; c=xz; h=BASE64; b=BASE64
    DKIM-Signature: acdc=2:DEOVYy; s=K2 ...
    DKIX-Signature: acdc=2:DEOVYy; s=K2 ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a(AT)b(DOT)c via x@y.z <x@y.z>
    ...
    List-Unsubscribe: bla

  u@v.w -- an expanded alias!
  The host honours RFC 3461, and changes MAIL FROM:

    MAIL FROM: <u@v.w>
    RCPT TO: <realu@realv.realw>
    ...
    DKIM-AC: sn=2; s=K2; f=u@v.w; d=realv.realw; t=realu; b=...
    DKIM-Signature: acdc=2:EOVy; s=K2 ...
    DKIX-Signature: acdc=2:EOVy; s=K2 ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a@b.c
    ...

  r@s.t -- an expanded alias!
  Note: will fail SPF of a@b.c without Mitigations'25!

    MAIL FROM: <a@b.c>
    RCPT TO: <realr@reals.realt>
    ...
    DKIM-AC: sn=2; s=K2; f=a@b.c; d=reals.realt; t=realr; b=...
    DKIM-Signature: acdc=2:EOVy; s=K2 ...
    DKIX-Signature: acdc=2:EOVy; s=K2 ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a@b.c
    ...

  o@p.q -- a mailing-list!
  It redistributes after RFC 2369 and RFC 2919 additions,
  in-message unsubscribe footer, without From: mitigation.
  Note: will fail DMARC of a@b.c without Mitigations'25!
  (This is why DKIM-Signature "1" is in.)

    MAIL FROM: <o@p.q>
    RCPT TO: <X@X.X>
    ...
    DKIM-AC: sn=2; s=K2; f=o@p.q; d=X.X; t=X; b=...
    DKIM-DC: sn=2; c=xz; h=BASE64; b=BASE64
    DKIM-Signature: acdc=2:DEOVYy; s=K2 ...
    DKIX-Signature: acdc=2:DEOVYy; s=K2 ...
    DKIM-Signature: acdc=1:O; s=K1; ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a@b.c
    ...
    List-Unsubscribe: bla

  l@m.n (recipient of x.y.z mailing-list), local delivery:

    ...
    DKIM-Signature: acdc=3:IVYy;
    DKIM-DC: sn=2; c=xz; h=BASE64; b=BASE64
    DKIX-Signature: acdc=2:DEOVYy; s=K2 ...
    DKIX-Signature: acdc=1:O; s=K1; ...
    From: a(AT)b(DOT)c via x@y.z <x@y.z>
    ...

Doesn't look bad, though i would have loved DKIM-Sig, the OpenPGP
people introduce a "sig" at the moment, that short it can be.

So now that it is for me.  I will post -07 with the above example
(maybe i'll add some more local delivery examples) and the
mentioned fixes, and with Mitigations'25 layed out.
I'd only wish we would get SMTP VERP extension, and, of course,
Implicit TLS SMTP!!  In addition that is.  The sheer amount of I/O
and roundtrips etc etc saved is beyond imagination.

Thank you,

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)
|
|During summer's humble, here's David Leonard's grumble
|
|The black bear,          The black bear,
|blithely holds his own   holds himself at leisure
|beating it, up and down  tossing over his ups and downs with pleasure
|
|Farewell, dear collar bear

_______________________________________________
Ietf-dkim mailing list -- ietf-dkim@ietf.org
To unsubscribe send an email to ietf-dkim-le...@ietf.org