Re: [apps-discuss] WGLC on draft-ietf-appsawg-rfc7001bis-05

[Scott Kitterman <[e-mail]>]

On Sunday, March 29, 2015 02:43:54 PM Alexey Melnikov wrote:
> This message is starting 3 weeks (*) Working Group Last Calls on
> draft-ietf-appsawg-rfc7001bis-05 (Message Header Field for Indicating
> Message Authentication Status). The WGLC ends on
> April 19th.
> 
> Please send your comments on the document in a reply to this message or
> directly to me. If you read the document and you think the document is
> ready for publication, saying so would also be helpful.

I've reviewed the document and believe it's essentially ready for publication.  
I think there is a bit of editorial adjustment needed in the prose about 
different a-r methods.

Here's my list of A-R related RFCs:

RFC 5451/7001 Message Header Field for Indicating Message Authentication 
Status
RFC 5617 DKIM/ADSP
RFC 6008 DKIM signature identification (header.b)
RFC 6212 Vouch By Reference (VBR)
RFC 6577 Sender Policy Framework (SPF)
RFC 7281 Authentication-Results Registration for S/MIME
RFC 7293 The Require-Recipient-Valid-Since Header Field
RFC7489 DMARC

Here's what the draft currently says about different methods:

  At the time of publication of this document, the following are
  published, domain-level email authentication methods in common use:

  o  Author Domain Signing Practices ([ADSP])
  o  SMTP Service Extension for Authentication ([AUTH])
  o  DomainKeys Identified Mail Signatures ([DKIM])
  o  Sender Policy Framework ([SPF])
  o  Vouch By Reference ([VBR])
  o  reverse IP address name validation ("iprev", defined in Section 3)

   In addition, the following are non-standard methods recognized by
   this specification that are no longer common:

  o  DomainKeys ([DOMAINKEYS]) (Historic)
  o  Sender ID ([SENDERID]) (Experimental)

I think the list misses DMARC, S/MIME and RRVS.  I also question the 
description of ADSP and VBR as "common".  Additionally, ADSP is historic.

Instead of getting into a bike shed discussion about what's common and how can 
we tell, what about something like this:

  At the time of publication of this document, the following are
  published, authentication methods:

  o  Author Domain Signing Practices ([ADSP]) (Historic)
  o  Domain-based Message Authentication,  Reporting and Conformance ([DMARC])
  o  DomainKeys ([DOMAINKEYS]) (Historic)
  o  DomainKeys Identified Mail Signatures ([DKIM])
  o  reverse IP address name validation ("iprev", defined in Section 3)
  o  Require-Recipient-Valid-Since Header Field and SMTP Service Extension
       ([RRVS])
  o  SMTP Service Extension for Authentication ([AUTH])
  o  Sender ID ([SENDERID]) (Experimental)
  o  Sender Policy Framework ([SPF])
  o  S/MIME Signature Verification [SMIME-REG]
  o  Vouch By Reference ([VBR])

None of these are marked deprecated in the registry:

http://www.iana.org/assignments/email-auth/email-auth.xhtml

As a result, I don't think we should treat them differently in the text beyond 
noting the status of the relevant RFC.

Scott K