I want to try to be precise, which I don't think Charles is being with
his below two sets of "facts". Let me try to clarify:
On 7/8/11 5:52 AM, Charles Lindsey wrote:
1. The fact that DKIM choose headers to sign from the bottom up (for good
reason) facilitates certain attacks (not against DKIM, but certainly
against somone/something) needs to be drawn to the attention of
implementors of identity assessors, so that they can take appropriate
action.
What Charles have written above is not true, or at the very least
extremely imprecise and confusing. Try this:
1a. The fact that DKIM signers can (optionally) sign a message in such a
way that header fields can be added to the top of the message by
intermediaries without invalidating the signature means that unsigned
header fields can appear at the top of a validly signed message needs to
be drawn to the attention of implementors...
1b. The fact that DKIM signers can sign header fields with all manner of
unverified data in them, including header fields that might violate the
syntax requirements of RFC 5322, without invalidating the signature
means that header fields with unverified data can appear in an validly
signed message needs to be drawn to the attention of implementors...
I *believe* what I said contains all of the information that Charles
wrote in his #1. If I missed something, please say.
But I also believe that the current security considerations section
*says* all that. If you think it doesn't capture something in the above
two statements, please say.
2. The fact that an attacker (whilst following DKIM to the letter) can use
it, in conjunction with duplicated headers, to add credence to his message
also needs to be drawn to their attention.
That one is simply bogus. The document repeatedly (and correctly) states
that having a DKIM signature *does not*, and *ought not*, in an of
itself, add any credence to a message. If that needs to be made clearer,
I'm all for it. But I think it is currently perfectly clear in the document.
In any event, neither of Charles suggested additions captured what I
have written above. I believe the current text does.
pr
--
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html