DKIM Chair wrote:
> In the IETF 74 DKIM meeting, we had a brief discussion about the current
> state of
> ADSP, given the recent discussions on i= (and other things). It seems to the
> chairs that ADSP isn't severely affected, and that changes would be needed
> only
> in section 2.7, "Author Signature", which is the only place that d= and i=
> are
> mentioned. Here's the current text (from -09), for reference:
>
>
>> 2.7. Author Signature
>>
>>
>> An "author signature" is a Valid Signature that has the same domain
>> name in the DKIM signing identity as the domain name in the Author
>> Address. If the DKIM signing identity has a Local-part, it is be
>> identical to the Local-part in the Author Address. Following
>> [RFC5321], Local-part comparisons are case sensitive, but domain
>> comparisons are case insensitive.
>>
>> For example, if a message has a Valid Signature, with the DKIM-
>> Signature field containing "[email protected]", then domain.example
>> is asserting that it takes responsibility for the message. If the
>> message's From: field contains the address "[email protected]", that
>> would mean that the message does not have a valid Author Signature.
>> Even though the message is signed by the same domain, it will not
>> satisfy ADSP that specifies "dkim=all" or "dkim=discardable".
>>
>> Note: ADSP is incompatible with valid DKIM usage in which a signer
>> uses "i=" with values that are not the same as addresses in mail
>> headers. In that case, a possible workaround could be to add a
>> second DKIM signature a "d=" value that matches the Author
>> Address, but no "i=".
>>
I'll start by proposing text that we could use if we adopted an
alternate definition of Author Signature based on the d= value only.
Then I'll describe what I think we'll lose by going to that definition.
Here's alternate text based on d=:
=====
2.7 Author Signature
An "author signature" is a Valid Signature where the domain of the
signing entity ("d=" value) is the same as the domain name in the Author
Address. This comparison is case insensitive.
For example, if a message has a Valid Signature with the DKIM-Signature
field containing "d=example.com" then example.com is asserting that it
takes responsibility for the message. If the message's From field
contains the address "[email protected]", that would mean that the
message does not have a valid Author Signature because the message is
not signed by the same domain.
Informative Note: ADSP is incompatible with DKIM signing by parent
domains described in section 3.8 of [RFC4871] in which a signer uses
"i=" to assert that a parent domain is signing for a subdomain.
=====
Here is what I see are the problems with this alternative:
1. As noted above, the use of d= means that signing by parent domains,
specifically called out in RFC 4871, doesn't result in Author
Signatures. This is arguably less of a problem because "ADSP by parent
domains" (the ability of a domain to assert ADSP for a subdomain) was
eliminated some time ago, so ADSP records would need to each for each
subdomain. However, management of key (selector) records in each
subdomain would still be required, while ADSP records require little or
no management such as key rotation or revocation.
2. It has been noted that a domain might have different reasons for
signing a message. It might, for example, sign a message on behalf of a
mailing list manager operating in that domain. When Author Signature is
based on a d= comparison alone, any signature from the same domain as
the author is assumed to be a signature representing the original
introduction of the message into the mail stream. That may or may not
be an important distinction, but I'm pointing out that information is
lost and I'm not sure we have enough experience to say that we don't
need it.
In the words of Dave Crocker,
> OK. Start shooting.
>
-Jim
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html
