If you get a message with 'Resent-From: dwmw2(_at_)infradead(_dot_)org' and
'Sender: owner-ietf-mailsig(_at_)imc(_dot_)org', where the address
'dwmw2(_at_)infradead(_dot_)org' has published that it'll always sign mail but
there's no valid signature from that address... do you accept that mail?
Of course. It'll be years before enough systems do signatures that
you can assume that an invalid or missing signature is more likely to
mean forgery than to mean brokenware. You might want to accelerate
the schedule for a relatively few domains like paypal.com that are
often forged and unlikely to mail through lists or other message
mutators.
The answer is that you should accept it if the Resent-From: header is
newer than the Sender:, but not if the Sender: is newer. If you can't
decide which is newer you have to give the benefit of the doubt.
You're definitely trying too hard here. If the signature verifies and
you like the signer, accept the message. If the signature verifies
and you don't like the signer, discard the message. If the signature
doesn't verify, treat it the way you would any other unsigned message.
If you have a signature and a reputation for the signer, why do you
care where the message has been on its way?
People have proposed all sorts of elaborate approaches to deal with
replay attacks. For a variety of reasons, none of them look practical
to me other than very simple techniques like timestamps so you can
reject really old messages. (If you want SES you know where to find
it).
My advice is again not to try. If you're seeing a bazillion copies of
a signed message from a sender who's supposed to be good, I would take
that as advice to the sender to be more selective in his choice of
correspondents. Or at least for the sender to contact the original
recipient and tell him to cut it out.
Regards,
John Levine, johnl(_at_)iecc(_dot_)com, Primary Perpetrator of "The Internet
for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.