-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]
.PROD.OUTLOOK.COM>, MCN-IETF <[email protected]> writes
>Why should an intermediary that has not been authorized by either the sender
>(e.g., an authorized outbound gateway) or the recipient (e.g., a recipient-
>controlled security gateway) be allowed to modify a message while preserving
>an
>authentication result attributed to the original From domain for the modified,
>delivered content?
I don't know, which protocol are you talking about ?
DKIM2 doesn't do that, you can determine that modifications have been
made and you will know which entity did those modifications.
I cannot find "allowed" in spec-09 in any related context.
>A recipient may choose to trust its own intermediaries and accept their
>modifications. That is entirely legitimate. But such local trust should not be
>confused with authorization from the original sender, nor should it imply that
>the original domain authenticated content modified by an unrelated third party.
Again, what protocol are you talking about ?
DKIM2 does not have the concept of "authorization" or "trust" ... it
merely records whether or not a system had access to a signing key and
to the contents of a message. The introduction is (intended to be)
crystal clear on the limits of what is being asserted.
You will find some woolly words about "responsibility" in the DKIM1
specification -- along with some cautions about trust. In that document
"authorized" is only used as being associated with access to private
keys.
In DKIM2 you will not find "responsibility" or "trust" in these contexts
at all (I agree with the cautions in the DKIM1 document about trust, but
spec-09 is a specification document, not a treatise on security
policies) and "authorized" is once again only associated with private
key access.
>IMHO an unknown or unauthorized intermediary should not receive the same
>treatment as a gateway explicitly trusted by the sender or the recipient.
There is nothing in DKIM2 that requires you to accept email that you
know to have been modified by an intermediary. However, many mailbox
providers wish to do exactly that (because the Internet is full of
intermediaries that alter messages). DKIM2 gives them considerable scope
to build reputation systems to label intermediaries and types of
modification. But we are not going to say that they are not allowed to
accept particular types of email -- their systems, their rules.
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBavRC9WHfC/FfW545EQJdAwCg7gxtO4D+HBG1hAMFjxrM5kdCy2oAn06d
EffDrOfNv2C9aMcH8WQeygzR
=npip
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
