ietf-mailsig
[Top] [All Lists]

Re: Yahoo!'s DomainKeys and Cisco's IIM have merged

2005-06-02 16:09:38

I hope I am not out of line throwing this out, but I feel it is important.

From my standpoint,  since there were so many proposals on the table, our
design responsibility was to prepare for the future by defining how to best
offer any or new protocols to our customers using our mail hosting software.

I believe a few has seen my advocacy on establishing a new "Generic SMTP
core framework" addressing how to best implement these new proposals.  Lets
call it SMTP TMS or SMTP Transaction Management and Security.

So whether it was IIM or DK or any other email security protocol like SPF,
CSV or SENDERID or anything down the pike,  we can frame it using a generic
EPV (End-Point Validation) functional model:

     Result := EPV(transaction data)

and this needed to fit into the SMTP model with backward compatibility
considerations.

For example, today, we can summarize the SMTP TMS model by state:

    IP:                 result := EPV(IP)
    HELO:           result := EPV(IP,HELO)
    MAIL FROM:  result := EPV(IP,HELO,MFROM)
    RCPT TO:      result := EPV(IP,HELO,MFROM, RCPT)
    DATA:           result := EPV(IP,HELO,MFROM, RCPT, DATA)
    POSTSMTP:  bounce := EPV(IP,HELO,MFROM, RCPT, DATA)

The reality is this.

IIM/DK  will be optional. Unless IIM/DK proves to 100% effectively solve all
TMS issues, there will always be new proposals to be explored - a better
mouse trap so to speak, including one that might be patented as well as not
patent restricted.  By framing it in this way generic way, then we can
remove IP related issues.

So there will always be a need to offer more than one TMS "plug-in" into the
SMTP framework.

So to answer your question, the real issue has been is how the final
result(s) will be possibly merged or produced and how it will be applied in
a local policy manner for enforcement, if any.

In my opinion, we should have an adjunct working group for SMTP developers
to begin discussing and defining a new SMTP TMS framework that will help
augment new promising proposals now and into the future.   This WG will need
to define how any TMS protocol will fit into the SMTP framework and help
define automation concepts and local policy concepts.   I believe there will
issues such:

1) Can a ESMTP protocol or advanced stamped message use HELO?
2) Are there any new ESMTP response keywords, modifiers?
3) What are the new response codes, if any?
4) What new Received: identifiers or new headers are necessary?

I guess the best example to what I am suggesting is how ESMTP AUTH and SASL
works today.   AUTH others a generic way to plug in any protocol for
authentication. It is not exclusive to just one SASL protocol.

As it relates to IM/DK and this has been my #1 concern with all 2822 based
mail integrity or payload dependent protocols,  is how to minimize the need
to accept
the payload at the transaction level.

My second concern is after it all said and done (a 'perfect' reliable
protocol is found) is how can we maximize enforcement.   While it is all
fine and dandy to increase the trust of a message from specific compliant
senders,  if SMTP vendors still need to cover the base for the non-compliant
world,  we need to make sure the IIK/DK senders comply with these other TMS
methods in place.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com


----- Original Message -----
From: "Edward Shallow" <ed(_dot_)shallow(_at_)rogers(_dot_)com>
To: "'Hector Santos'" <hsantos(_at_)santronics(_dot_)com>; "'Andrew Newton'"
<andy(_at_)hxr(_dot_)us>
Cc: "'IETF MASS WG'" <ietf-mailsig(_at_)imc(_dot_)org>
Sent: Thursday, June 02, 2005 5:41 PM
Subject: RE: Yahoo!'s DomainKeys and Cisco's IIM have merged



How do the proponents of the META Signatures proposal feel on this
announcement ?

William ?

-----Original Message-----
From: owner-ietf-mailsig(_at_)mail(_dot_)imc(_dot_)org
[mailto:owner-ietf-mailsig(_at_)mail(_dot_)imc(_dot_)org] On Behalf Of Hector 
Santos
Sent: June 2, 2005 3:59 PM
To: Andrew Newton
Cc: 'IETF MASS WG'
Subject: Re: Yahoo!'s DomainKeys and Cisco's IIM have merged



----- Original Message -----
From: "Andrew Newton" <andy(_at_)hxr(_dot_)us>
To: "Larry Seltzer" <larry(_at_)larryseltzer(_dot_)com>
Cc: "'IETF MASS WG'" <ietf-mailsig(_at_)imc(_dot_)org>
Sent: Thursday, June 02, 2005 4:30 PM
Subject: Re: Yahoo!'s DomainKeys and Cisco's IIM have merged


On Jun 2, 2005, at 10:18 AM, Larry Seltzer wrote:

They've announced that they will combine the specs, not that it's
done or
that the spec is available. It isn't.

This shouldn't detract from the fact that this is good news.


Excellent point.  It will certainly make life easier for implementators!

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com













<Prev in Thread] Current Thread [Next in Thread>