Subject: [ietf-dkim] Ticket #19

From: Dave CROCKER <[email-masked]>
Date: Tue, 26 Apr 2011 14:13:35 -0700

> *... Recognizing the role of a signer can be important for inferring the
> semantics of any signed content.
>
> * A signature can be identified as pertaining to an aliasing or resending MLM
> if the domain-part of the List-Post field matches the signing domain.

I think I understand the intent, here, and I'm supportive of the goal.  However 
the text is technically invalid.  A DKIM signature has only one meaning, 
relative to existing, formal specification.

"Inferring" meanings beyond what is defined is very, very far outside of the
scope of DKIM and it isn't documented anywhere, including the MLM document.

To the extent that there is a desire to specify additional, standardized 
semantics when an MLM adds a signature, that requires an additional, 
standardized specification (and almost certainly an additional, standardized 
header field...)

The best I can suggest is something along the lines of noting that
assessment-level heuristics can be aided by certain choices of signature d= 
names.  And then specifying what they might be, so that both signers and 
verifiers know how to encourage success for the heuristics.

mumble.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 26 Apr 2011 14:17:50 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Dave CROCKER
> Sent: Tuesday, April 26, 2011 2:14 PM
> To: DKIM IETF WG
> Subject: [ietf-dkim] Ticket #19
> 

But doesn't the proposed text do that?

Perhaps a merge of that text and this paragraph would do nicely.

---

From: "John R. Levine" <[email-masked]>
Date: 26 Apr 2011 19:07:28 -0400

> Perhaps a merge of that text and this paragraph would do nicely.

I have to agree with Dave.  This is way outside anything that DKIM 
specifies, it's the "first party" vs. "third party" distinction that I 
hope we have buried for good.

Although I understand the motivation, if we're serious that DKIM 
signatures mean what the mean, it needs to go.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Tue, 26 Apr 2011 21:01:36 -0400

> hope we have buried for good.

Bury things alive, not making sure its not dead first or trying to get 
rid of significant distinctions tends to come back to haunt us.

-- 
HLS

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 27 Apr 2011 12:53:23 +0200

> scope of DKIM and it isn't documented anywhere, including the MLM document.

Yes, "any possible owner-specific semantics are outside the scope of
DKIM."  However, the MLM does explore circumstances outside such
scope.  Perhaps, this can be said explicitly:

   A signing MLM can make its role apparent by properly choosing the
   signing domain, SDID, the one used in the "d=" tag of the DKIM
   signatures added by the MLM.  Recognizing the role of a signer
   allows to infer implied semantics that are outside the scope of
   DKIM.  Two criteria are as follows:

   * A signature can be identified as pertaining to an aliasing or
     resending MLM if the domain-part of the List-Post field matches
     the signing domain.

   * When no List-Post field is present, a signature can be
     identified as pertaining to an authoring or digesting MLM if the
     list-id-namespace (see [LIST-ID]) matches the signing domain.

   These spontaneous bindings are assessment-level heuristics whose
   use is hereby suggested.  They are not specified by any currently
   existing standard, and not required.

(I left off that "the reputation of the signer will be a more critical
data point".)

---

From: Hector Santos <[email-masked]>
Date: Wed, 27 Apr 2011 08:16:14 -0400

> verifiers know how to encourage success for the heuristics.

Chuckling. Warning: Such mumbles only presage more far-reaching 
developments to come. :)

There will always be a choice or choices for the selection of a SDID 
that will  reflect a controlled decision for the equal or better 
outcome, hopefully not worst. I don't see this done in random.

-- 
HLS