Hi!
On 6/29/26 15:35, Bron Gondwana wrote:
[...]
- How is the mf/rt chain checked in the presence of nd? Just skip
the nd
hop? I.e. if i=4 has mf/rt, i=5 has nd, i=6 has mf=rt, do I check i=6
against i=4 using the usual rules?
No, you never skip over a hop. You check:
i=4 rt=foo@X
i=5 d=X; nd=Y
i=6 d=Y; mf=bar@Y
(Reformatted, your formatting gave me white on white in my message
composition editor.)
Those are the invariants which must pass.
They look much stricter than the usual checks.
If i=5 where a "normal" intermediate signature,
- i=6 the mf domain would be allowed to be a subdomain of the d domain
- The i=4 rt domain would be only very loosely related to the i=5 d
domain (indirectly via the i=5 mf domain) Basically i=5 mf could be
any subdomain of i=5 d, and i=4 rt domain could be any "super"domain
(suffix) of that. That is, i=4 rt can be either the same as i=5 d, or
one a subdomain of the other (this way or the other way)!
And once, we'd adjust for that, I'm not sure what we gain from nd
over just having some synthesized/fictitious mf/rt on i=5 instead of nd.
I.e. i=5 d=X mf=fictitious@X rt=fictitious@Y
Yes, that was indeed the discussion. The point of nd= rather than
fictitious part was to make it clear that the same party (or: related
parties that can be treated as the same) was creating both signatures.
Then I'd suggest that the "nd" hop also declares mf/rt (if need be,
fictitious) as usual. The function of "nd" would then be only for a
clearly defined strictness (restrict who can sign the next hop and
declare that there's a relationship).
Hannah.
--
Hannah Stern
Software Developer
Mail Transfer Development
1&1 Mail & Media Development & Technology GmbH | | |
Phone: +49 721 91374-4519
E-Mail:[email protected] | Web:www.mail-and-media.com www.gmx.net www.web.de www.mail.com www.united-internet-media.de
Hauptsitz Montabaur, Amtsgericht Montabaur, HRB 5452
Geschäftsführer: Alexander Charles, Dr. Michael Hagenau, Thomas Ludwig, Dr.
Verena Patzelt
Member of United Internet
Diese E-Mail kann vertrauliche und/oder gesetzlich geschützte Informationen
enthalten. Wenn Sie nicht der bestimmungsgemäße Adressat sind oder diese E-Mail
irrtümlich erhalten haben, unterrichten Sie bitte den Absender und vernichten
Sie diese E-Mail. Anderen als dem bestimmungsgemäßen Adressaten ist untersagt,
diese E-Mail zu speichern, weiterzuleiten oder ihren Inhalt auf welche Weise
auch immer zu verwenden.
This e-mail may contain confidential and/or privileged information. If you are
not the intended recipient of this e-mail, you are hereby notified that saving,
distribution or use of the content of this e-mail in any way is prohibited. If
you have received this e-mail in error, please notify the sender and delete the
e-mail.
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
