On Jan 6, 2009, at 6:06 PM, MH Michael Hammer (5304) wrote: > I'll stick t o inline comments at the risk of this getting confusing. > >> -----Original Message----- >> From: Jim Fenton [mailto:[email protected]] >> >> Suppose that ietf.org asserts an ADSP record but doesn't require >> signatures on incoming messages, even from its own domain (there's >> no requirement that they do). Someone spoofs a message from >> [email protected], which is of course unsigned. The message coming >> out of the list looks like it has an author signature. I have a >> problem with that.
An ADSP signature represents the Domain of the Author, and not that of the Author. > If ietf.org is willing to put it's signature on the spoof message I > would assert that it has a DKIM problem more than an ADSP problem. Since the From is always included within a DKIM signature, when just d= compliance is required, it remains a matter of signing policy as to which message is signed by the domain. If they have asserted that all of their email is signed, then proper list operation should not require a signature unable to indicate for which entity the message had been signed. The signature should not be forced to affirm a From email-address, as might be the case with mailing lists. The more fundamental aspect as to how an acceptable ADSP signature is defined, and whether it changes the RFC4781's definition for the i= parameter. > Either the message has a valid signature or it does not. If there is > a valid signature then ietf.org is claiming responsibility. If it > doesn't have a valid signature....then not so much. If ietf.org is > sending out spoofed messages spoofing a "from" then it has a problem > regardless of whether it DKIM signs, uses ADSP or does anything else.. This of course would only be a problem when the domain used within the mailing list corresponds to the same domain as used by a mailing list. When the i= does not match with that of the From, it should be obvious the signature is not indicating prior authentication of the From entity. ... >> The d=/i= distinction was originally created to simplify key >> management by domains having many subdomains, in that they could >> publish the keys in a parent domain (d=) while signing for a >> subdomain (i=). You're basically suggesting that we abandon that >> optimization so that we can use the d= domain rather than the i= >> domain for ADSP. > > I'm too tired to wade back through the list to find the discussion > that included statements from receivers that for the most part the > finer granularity desired by some senders was not necessarily useful > from the receiver perspective. I'm not going to argue with > receivers. I sign email with DKIM because it helps them identify > legitimate mail from our domains vs the spoofed mail. For my use > case I try to keep it as simple as possible. I do not agree that by not restricting the use of the i= parameter, beyond what is already required by RFC4871 when assessing ADSP compliance, abandons any optimization. The i= parameter will still allow the signature to communicate for which entity was the signature added. In the normal range of email, there will be cases where a message is not introduced by one of the entities found within the From header field. Basing compliance upon the d= parameters matching still allows the domain to determine what email they are willing to sign, and importantly, indicate on whose behalf the signature was applied. (The original definition of the i= parameter.) I tend to agree with Michael more than Jim on this topic. -Doug _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
