qvcimnfiqkwxudxmipassocorg send ietfdkim mailing list submissions gfkyhddlmipassocorg subscribe unsubscribe via world wide web visit httpmipassocorgmailmanlistinfoietfdkim via email send message subject body help qvcimnfiqkwxudxmipassocorg reach person managing list qghtrnrqbhlpvmipassocorg replying please edit subject line specific contents ietfdkim digest todays topics 1 ssp02 problem author signature douglas otis 2 ssp02 problem author signature douglas otis udcatmailabuseorg sun feb 24 103045 2008 message 1 date mon 18 feb 2008 153354 0800 douglas otis subject ietfdkim ssp02 problem author signature dkim list messageid 568bfd6a292e46b4b766bcabb4ab120cmailabuseorg contenttype textplain charsetusascii formatflowed delspyes per rfc 4871 signatures parameter expected contain onbehalfof information identity user agent eg mailing list manager behalf message signed informative discussion document require value tag match identity message header fields definition fairly useful since allows signing domains provide reporting token within parameter verifiers use identify agent creating problem token obscured transient hash account used access outbound servers example ssp02 28 author signature author signature valid signature identity user agent behalf message signed listed tag default value tag matches author address header emailaddress message 33 ssp record syntax mail domain signed author signature translation signatures onbehalfof header emailaddress considered compliant ssp policy conflict rfc 4871 signatures onbehalfof entity represented header course essentially necessitates parameter used identity might conflict identity contained within header parameter parameter defined providing higher granularity message sources longer useful cases help verifiers cope abuse doesnt per rfc 4871 signature valid signed onbehalfof identity parameter relate header email address however ssp02 definition prevents parameters useful role result many cases parameter unable identify actual agent user introduced message using obscured hash identity agent related resentfrom sender header doug udcatmailabuseorg sun feb 24 103045 2008 message 2 date tue 19 feb 2008 030408 0800 douglas otis subject ietfdkim ssp02 problem author signature douglas otis cc dkim list messageid 6b3d6655bf9642169e16a6b0df3c5a25mailabuseorg contenttype textplain charsetusascii formatflowed delspyes expanding upon effect ssp02 author signature definition based upon conversation jim jim suggested comply ssp02 signatures make use parameter since parameter needed g restricted keys instead practice offers explicit token even one opaque identifying useragent introduced message examining header stack guessing header might apply becomes necessary also unknown whether entire header stack captured within signatures hash guessing may also prone introduction spoofed headers attempting resolve top identifiers secondly also means muas attempting highlight signature indicates introduced message also prone getting wrong signatures identity must absent whenever entity introducing message _not_ represented emailaddresses within header although unlikely domains may feel compelled sign message twice one signature comply ssp02 author signature definition another clarify actually introduced message result instead dkim offering reportable displayable identifier clarifying introduced message identifier must guessed jims example definition needed offers yet another problem scheme jims example users maillist examplecom examplecom ssp asserts sign messages messages signed mailinglist contain identifier mailing list found within fromsenderresent headers whereas user messages signed parameter either containing identity within header left blank especially user represented header header stack unknown whether entire stack included within signature hash guessing needed selecting specific top identifier might prone spoofing parameter blank identity introduced message doubt addition messages signed mailinglist also noncompliant signed assertion likely rejected goal scheme protect line message legacy muas work protecting line must role signer verifier signer offer keys untrustworthy entities points sender header key g restricted header contains user within domain message filtering able identify type message fairly odd modern muas able highlight identity making message also appear odd recipient imho rfc 4871 declared nonfrom header signatures g restricted keys invalid g restricted key used nonfrom headers represents corner case corner cases extremely odd use primary reason extremely convoluted author signature definition recommendation 1 change author signature author domain signature 2 change author signing policy author domain signing policy 3 accept premise author domain signs message message complaint author domains signing policy _by definition_ 4 message signed author domain author domain signing policy need checking doug _______________________________________________ note well list operates according end ietfdkim digest vol 108 issue 2 wed 06 aug 2008 233226 0800 ietfdkim digest vol 108 issue 2