Bron Gondwana writes: > Removal isn't possible with DKIM2 - not entirely - unless you use > NULL recipes, or provide the instructions to recreate the original > message. Which means you're basically either re-originating the > message, or at least doing a NULL body recipe.
I do have a feeling that we are going to see lots of NULL body recipies... > There is no "benign entire removal" possible with the current > hashing mechanism. We could of course modify the hashing mechanism to be such that complete MIME parts could be removed (i.e., hash each mime part separately, and then generate body hash by hashing combintion of those hashes, in which case there would be remove MIME part xxx having hash of yyy, and then even when the final recipient is not able to reconstruct the missing body part, it can verify that there used to be such body part and verify the original signature). > Which basically means, as has been stated by Richard many times in > many IETF calls and emails (and by me) that what you're doing needs > a trust relationship with either the sender (in which case you > re-originate) or the final recipient (in which case they override > the PERMERROR for known sources, basically they don't re-validate > DKIM2 if the message comes from you, they trust your validation). Unfortunately that does not work. I am pretty sure google/yahoo/etc are saying no, when I say that for my emails they should trust DKIM2 results from the iki.fi which will be forwarding my emails to there. They have not been able to implement such feature for the ARC, so I am not holding my breath that they will implement it for DKIM2. > Recipient can ask for whatever they want, they're the recipient. > We're not the protocol police, they can have a relationship which > overrides DKIM2. Recipients can do that, but forwarders can only do that if the final recipient accepts ARC or some other signal, and allows me to configure that this forwarder verified DKIM2 for me, and the final recipient should trust its resolutions and accept email even when the DKIM2 signature did get broken because of the changes done. -- [email protected] _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
