> My understanding is that a signing party is vouching for the message. This > means that it is providing an assurance that the message contents, including > originating address fields, are authorised. If the signing party is > unwilling or unable to provide this assurance, then they should not apply a > signature. The receiving party can place a value on this assurance > depending on a variety of factors (relationship to originating address, > reputation, etc).
I doubt that it's a good idea to insist that those semantics be associated with every signature, as it would drastically impede the ability of intermediaries to sign messages. For instance, a list should be able to sign a message in such a way as to mean "this message was sent to you from this list" but not to make any assurances about the content of the message. Basically all that signing a message inherently means is "I saw the message when it looked like this". This is a useful service by itself, but there are situations when we'd like a signature to say more than that. If we want to add additional semantics to a particular signature they should be (a) explicit, and (b) decoupled from the message itself. What (b) probably implies is that any explicit semantics associated with a signature need to be contained in the message header(s) that represent the signature, rather than in any of the headers that are signed by the signature. Keith _______________________________________________ ietf-dkim mailing list http://dkim.org
