Subject: Re: [Asrg] Third party DKIM signatures

From: Dave Crocker <[email-masked]>
Date: Sun, 28 May 2006 15:43:10 -0700

John R Levine wrote:
> DKIM lets anyone sign any message, with no necessary connection between
> the signing domain and the domain in any other header such as From: or
> Sender:.  By third-party signatures we mean signatures that don't match
> the From: or don't match the Sender:, or don't match something else.
> 
> The semantics as well as definition of third party signatures are, to put
> it mildly, somewhat unclear.  Some thought or actual experiments with such
> signatures could be helpful.

I think the above characterization has the issue reversed, or worse.

 From the DKIM base specification:

> 1.1  Overview
> 
>    DomainKeys Identified Mail (DKIM) defines a mechanism by which email
>    messages can be cryptographically signed, permitting a signing domain
>    to claim responsibility for the introduction of a message into the
>    mail stream.  Message recipients can verify the signature by querying

and

> 1.2  Signing Identity
> 
>    DKIM separates the question of the identity of the signer of the
>    message from the purported author of the message.  In particular, a
>    signature includes the identity of the signer.  Verifiers can use the
>    signing information to decide how they want to process the message.
> 
>       INFORMATIVE RATIONALE:  The signing address associated with a DKIM
>       signature is not required to match a particular header field
>       because of the broad methods of interpretation by recipient mail
>       systems, including MUAs.
> 
> 

First, this makes the semantics of the signature anything but ambiguous, or at 
least it focuses any ambiguity on the word "responsible" rather than on the 
choice of identity.

Second, it explicitly decouples the responsible identity from any other identity 
in the message.

To repeat:  the semantics of a DKIM signature are actually quite clear and 
precise.  I'll even go so far as to suggest that a receive-side filtering engine 
has utterly no concern with whether the signature identity matches the From 
identity's domain.

Although many folks expect a coupling to exist with the From domain reference, 
that is a *value-added* matter for DKIM, rather than an issue with the basic 
mechanism.

Yes, the sender signing practises document considers the topic, but that 
document has received little serious review.  So we should be a bit cautious 
about characterizing the issue in a particular way.

For example, all of this concern about having the signing identity and 
rfc2822.From identity be different mostly asserts that there is a problem, 
without explaining its nature very clearly or substantiating the validity of the 
problem.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John L <[email-masked]>
Date: Mon, 29 May 2006 12:10:27 -0400 (EDT)

> without explaining its nature very clearly or substantiating the validity of 
> the problem.

I basically agree.  As you have noted, people seem to think that it means 
something if the signing domain and From: domain are the same.  I was 
hoping I could tease out what that meaning is supposed to be.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: "Dan Oetting" <[email-masked]>
Date: Wed, 31 May 2006 18:26:25 -0600

On May 29, 2006, at 10:10 AM, John L wrote:

>> For example, all of this concern about having the signing identity  
>> and rfc2822.From identity be different mostly asserts that there  
>> is a problem, without explaining its nature very clearly or  
>> substantiating the validity of the problem.
>
> I basically agree.  As you have noted, people seem to think that it  
> means something if the signing domain and From: domain are the  
> same.  I was hoping I could tease out what that meaning is supposed  
> to be.

I think it is an attempt to integrate the current world with some  
authentication provided by the DKIM signature. Current systems such  
as mailing lists rely on the From identity. If a trusted ISP were to  
sign the message saying that the From address is valid for the user  
that authenticated with the ISP then the mailing list would be able  
to trust the From address. This has the obvious problems of how does  
the mailing list assign trust to the ISP and how does the ISP learn  
all of the valid addresses of it's users.

For a mailing list, the real solution is direct user authentication  
and to disregard the ISP or other delivery agent. The users signature  
says only that the sender is the same entity that was confirmed  
during the subscription process. The list would associate the From  
address with that entity and no other entity would be allowed to use  
that From address through that list.

For the interim, a user could subscribe to a list through an ISP that  
adds DKIM signatures. Instead of the mailing list needing to  
determine the trust of the ISP it is the user that assigns trust to  
the ISP that carries his messages. Only a forgery that used the same  
ISP would then be accepted by the list. It would be up to the user to  
then sort the problem out with the ISP.

It may help to preemptively address the forgery issue if the ISP were  
to insure that the From address were valid before signing the  
message. But this is an issue between the ISP and the user. If an ISP  
is going to allow forged addresses why would their signature  
verifying the address make any difference?

-- Dan Oetting