Hello Pete,
On 11 Sep 2026, at 21:37, Pete Resnick wrote:
First, let me say that you are the only one to be making the argument
that there is security risk involved; even Vittorio, who objects on
complexity grounds, is not claiming that.
One correction for the record, on my own position only.
The characterisation of JSON parsing as a security concern is in
draft-moccia-dkim2-deployment-profile since the -00 version, published
in March 2026, in a Security Considerations subsection titled "JSON
Parsing Attack Surface". It identifies, among other concerns, parser
behaviour on duplicate keys and numeric precision as a source of
divergent interpretation between hops and includes a normative
requirement to reject objects with duplicate keys. In that document the
analysis is applied to body recipes.
On the header path the same reasoning is part of why that document
specifies header modifications in tag-value form rather than JSON and I
stated this on this list on 9 September, in the thread on base64+JSON.
To be accurate about my own position, the security consideration is one
of several. Others include parsing cost at scale, the loss of streaming
processing with constant memory and the opacity of routing information
in operational logs. I do not hold it as the sole or decisive objection
and I am not asking the working group to treat it as one.
The scope of my objection is also narrower than the discussion in this
thread: it concerns JSON on the header path, where tag-value already
expresses the same information. Body recipes are a separate question.
I have no comment on the other points raised in this thread.
Regards,
Vittorio Moccia
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
