Bron Gondwana wrote in <5df9212c-5014-4323-8d70-fbc7d044b...@app.fastmail.com>: |Honestly, with the capacity to undo header changes from dkim2-modificati\ |on-algebra I would be more inclined to have the spec list headers which \ |MUST NOT be signed (probably just trace headers), and to list additional \ |headers to not sign, rather than additional headers to sign.
For DKIMACDC we simply go with DKIM. |I would also mention here than one thing we (or at least I) want to \ |change between DKIM and this new spec, is that every instance of any \ |signed header is signed, there's no "oversigning" where you have to \ |list "Subject" twice in the list to avoid somebody adding a second \ |Subject header which displays in some systems despite the first one \ |being the one that's checked by the signature verifier. With DKIMACDC, if you do change the message, you need to "claim the message origin", aka set the "O" flag, plus a bit. This goes very much in line with the SMTP protocol i think. (Like the "postmaster" mode, which is in total sync with SMTP.) Ie, "normally" changes of a message do not occur. But for example if i address a mailing-list, that may change the message, and it then dispatches to other subscribers, so it is, de facto (i made my peace with that), the "originator". That is to say, that with DKIMACDC that problem does not occur. It is a RFC 5322 IMF message that is sent via RFC 5321 SMTP, and therefore the usual RFC 6376 DKIM policy kicks in. If you oversign/seal (most "small" people do, when i look around here; others do not, mostly bogusly administred things ******** ******************************; but really, most others do), you simply include one instance more than exists. That is Postel, right, if the IMF is wrong per se, at least the signature does not make things worse. Having said that, i can imagine that both the list of headers to be signed that is carefully laid out in RFC 6376 can be updated to reflect other IETF standards in use (but then not that "magic" list of the mystic group of elected that will create papers soon; that is both, in my opinion, arbitrarily mutilated and arbitrarily selected), and that oversigning is more offensively propagated. In my world, many, many "personal" (private domain that is) messages come completely without DKIM by themselves. (These include a lot of UNIX old hands, active often since the 70s even; if DKIM, then only via mailing-lists in the middle.) In that world those which have, and that includes the mailing-lists "in the middle", most often have very careful configurations, and that then includes oversigning. For ACDC no discussion, except possibly updating the comprehensive list of 6376 as such. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) _______________________________________________ Ietf-dkim mailing list -- ietf-dkim@ietf.org To unsubscribe send an email to ietf-dkim-le...@ietf.org
