Subject: [ietf-dkim] Fluffy DKIM questions

From: Steve Atkins <[email-masked]>
Date: Tue, 15 May 2007 12:08:09 -0700

As a distraction from the deeply technical stuff, I have
some PR / deployment related questions. I'm looking
for answers that are suitable for a user intending to
deploy, rather than a developer intending to implement.
I'm also talking solely about dkim-base, not about any
of the bags on the side.

1. Does anyone have an overview of the benefits and
     drawbacks to DK and DKIM in general?

2. How about the differences between DK and DKIM?

3. Is a valid DK signature a valid DKIM signature?

3b. If the general answer to that is "no", are some subsets
     of DK signatures also valid DKIM signatures?

4. What are the Intellectual Property implications of
     deploying DKIM? (The Yahoo DK license agreement
     has scared off a number of people from implementing
     or using it).

I think I know the answers to some of these, but I
thought I'd throw them out here anyway.

Cheers,
   Steve

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eric Allman <[email-masked]>
Date: Tue, 15 May 2007 13:10:41 -0700

I can answer some of these, but not all.

>      drawbacks to DK and DKIM in general?

I think there's been several short descriptions, although I don't 
think I've seen a definitive analysis.  I believe the intro to the DK 
document includes a summary, but I haven't actually read it in a year 
or so.

> 2. How about the differences between DK and DKIM?

I've got that on my to-do list, but I'm not going to be able to get 
to it before next week.

> 3. Is a valid DK signature a valid DKIM signature?

No.

>      of DK signatures also valid DKIM signatures?

No.  Among other things, they use different signature headers.

>      has scared off a number of people from implementing

So far as I know, everything should be completely open for use.  I 
think that the Yahoo! claims may apply to DKIM as well, but so far as 
I know they have completely addressed those issues.  Their most 
recent IPR disclosure is at 
<https://datatracker.ietf.org/public/ipr_detail_show.cgi?ipr_id=716>. 
The interesting bit reads:

        Yahoo! licenses its Necessary Patent Claims contained in the
        patent(s) and patent application(s) disclosed above under
        either of two separate license agreements, one of which is
        the DomainKeys Patent License Agreement (v1.2), and the other
        is the GNU General Public License v2.0 (and no other version).

I'm not sure what it means to apply the GPL to a patent license, but 
there it is.

eric

---

From: Dave Crocker <[email-masked]>
Date: Tue, 15 May 2007 13:16:23 -0700

Steve,

Please take a look at <http://dkim.org/info/dkim-faq.html> and then re-send 
your note with the questions that it doesn't answer. At the least, this will 
give me some input about the faq's utility.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jim Fenton <[email-masked]>
Date: Tue, 15 May 2007 13:23:01 -0700

I'll take a shot...

>     drawbacks to DK and DKIM in general?

There's a lot written about that in various places, but here's my view
(excluding the "bags on the side", per your request):

- There's the general benefit to e-mail authentication, that it
increases trust.  But more specifically, I can whitelist authenticated
messages from domains that I trust, and make sure their messages always
get through.  This is important for a lot of domains that depend on
their ability to receive mail to support customers, process orders, etc.

- Email authentication is beneficial in that it enables accreditation
and reputation based on the domain name, rather than on the IP address
of the sending MTA.  This is perhaps a "bag on the side", but since
authentication enables something desirable, I see it as a benefit.

- DK and DKIM do this in a way that "transparent" forwarding preserves
the authentication.  We don't have much data about hot much this is
actually done and there is some evidence that this represents a small
percentage of e-mail messages, but I consider forwarding to be an
important use case because it gives users the equivalent of "local
number portability":  they can change providers without changing e-mail
addresses.
> 2. How about the differences between DK and DKIM?

In general, DKIM is more tightly specified.  For example, it requires
that the header fields being signed be listed in the signature, and
specifies rules for what to do with duplicate header fields.  It also
has some extensions to DK, such as the body length count, ability for
finer-grained validity and delegation of keys, and canonicalization choices.

No.
>     of DK signatures also valid DKIM signatures?

No.  There is, however, compatibility in the key records ("selectors"):
DK key records can be used by DKIM, although the reverse isn't
necessarily the case.
>     has scared off a number of people from implementing

IANAL, so I don't have an answer to this one.  If anyone is scared away,
please let us know.

-Jim

---

From: Steve Atkins <[email-masked]>
Date: Tue, 15 May 2007 13:57:49 -0700

On May 15, 2007, at 1:16 PM, Dave Crocker wrote:

> Steve,
>
> Please take a look at <http://dkim.org/info/dkim-faq.html> and then  
> re-send your note with the questions that it doesn't answer. At the  
> least, this will give me some input about the faq's utility.
>

The FAQ is a generally good, brief, high level overview of
the positive aspects of the technical details of the protocol.
It leaves many of the implications of those details to
the imagination of the reader - and some of those implications
are subtle and easy to get wrong, so there's risk of people
coming away with quite different (and possibly wrong) ideas
of what DKIM deployment will actually mean to them.

Rephrased, then:

1. What are the drawbacks of deploying DKIM or DK+DKIM
     compared to not deploying it. What are the direct business
     benefits of signing with it? If I'm checking against it, what
     does a valid signature mean? An invalid signature? A
     missing signature? What should I consider doing in those
     cases? What *shouldn't* I do?

(Signing and validation cost. Widespread misunderstanding
of what mail whose signature does not validate means.)

2. What are the advantages of DKIM over DK to me as a
     sender or as a receiver of mail? Why did you change it
     all in an incompatible way, so I have to support both?
     Does the standardisation of DKIM mean that DK is dead?

(This also leads into senders questions along the lines of
  "You told me SPF was The Answer,so I deployed SPF and
I still need to support that because some recipients still check
it. Then you told me DK was The Answer, so I deployed that,
and I still need to support it because some recipients still
check it. Now you're telling me that DKIM is The Answer.
Why should we believe you this time? How many incompatible
sender authentication technologies are we going to have to
support for all time?" OK, maybe more of a whine than a
question, but they do have a point.)

3. Should I sign with DKIM? DK? Both? If I should sign with
     both is there any best practice as to how to do so? Should
     I expect a recipient to check DKIM or DK or both? Is there
     a flag day when I should stop signing with DK?

(I've seen reports of odd and broken behaviour from some
recipients for mail signed with both DK and DKIM, and I'm
getting questions as to which people should use.)

4. What does "Licensee hereby grants Yahoo! and its
     subsidiaries a license under all patent claims owned
     or licensable by Licensee without requirement of paying
     additional consideration to make, use, sell, offer for sale,
     import and/or license any Implementations." mean, and
     do I need to care?

(I know what I think it means, and I don't care, but some of
the people I'm talking to about deployment are concerned
by it, and even minor reasons not to consider DKIM deployment
right now would be good to avoid.)

All this is stuff that I can answer, I think, but it's something
that there should be a consistent message for, so I was
hoping someone else had already put together something
or at least thought about how to communicate it. Jim's
response was quite useful there, I think.

Cheers,
   Steve

>> NOTE WELL: This list operates according to http://mipassoc.org/ 
>> dkim/ietf-list-rules.html
>
> -- 
>
>   Dave Crocker

---

From: John Levine <[email-masked]>
Date: 15 May 2007 23:02:00 -0000

>     of DK signatures also valid DKIM signatures?

It's worth clarifying that you can easily create a single key record
that is valid both for DK and DKIM, and you can put both DK and DKIM
signatures on a message that use that key record.

>     deploying DKIM?

If there's IP problems, I sure want to know about it, too.

R's,
John

---

From: Dave Crocker <[email-masked]>
Date: Tue, 15 May 2007 14:38:09 -0700

Eric Allman wrote:
> I've got that on my to-do list, but I'm not going to be able to get to 
> it before next week.

The FAQ includes this as an explicit entry.  If it needs changing, let me know.

-- 

   Dave Crocker