Wietse Venema wrote:
Dave Crocker:
Stephen Farrell wrote:
1521 Limit the application of SSP to unsigned messages new dkim
Nobody 0 dhc(_at_)dcrocker(_dot_)net 9 days ago 9 days ago 0
Proposal: REJECT, but some wording changes may be needed for the next
rev, thread is [4] I mainly saw opposition to the change suggested in
the issue, and little support, but some text clarifying changes were
suggested (e.g. [5]). [4]
http://mipassoc.org/pipermail/ietf-dkim/2007q4/008424.html [5]
http://mipassoc.org/pipermail/ietf-dkim/2007q4/008467.html
Would you please explain the basis for assessing that this topic got
sufficient discussion and that there was rough consensus on it?
See above "I mainly saw..."
Summary of proposal:
All text that causes SSP to be applied to an already-signed message
needs to be removed.
I would take this further: remove all text that says when to apply
SSP. Instead, provide text that states the contribution that SSP
can make under different conditions: mail with valid first-party
signature, mail with valid third-party signature, and mail without
valid signature.
I mostly agree with Wietse's proposal. Yes, I'm aware that diverges
sharply from the current draft.
The original proposal in the issue, "All text that causes SSP to be
applied to an already-signed message needs to be removed," could be
interpreted as discouraging the use of SSP anytime there is any valid
signature on a message. I certainly read it that way at first, and from
some of the responses I have seen, others are reading it that way too.
If there's a signature on a message that the verifier trusts
sufficiently that they're going to treat the message as valid, then
there isn't a lot of point in retrieving the SSP record. Note that I
say "trusts sufficiently" because trust isn't a black-and-white thing; a
verifier might trust some signatures completely, and accept mail bearing
those signatures regardless. Other signatures, (e.g., from a mailing
list) might be trusted enough to accept mail from some domains, but not
from a domain that is used exclusively for transactional email. The
verifier also might use SSP to determine which domains fall into this
transactional category. But it's up to the verifier to decide when SSP
adds value, and retrieve it then.
The current normative language in SSP was an attempt to:
(1) Define SSP in such a way that SSP, taken alone, produces a
deterministic result, even though it was recognized that the SSP result
would be combined with other things in determining the ultimate handling
of the message
(2) Avoid placing a normative dependence on reputation, accreditation,
and other things that are out of the scope of the WG. The widely
misunderstood term "verifier acceptable third-party signature" was a
subtle nod to reputation, but it seems it was far too subtle.
-Jim
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html