Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Dave Crocker <[e-mail]>]

On 7/18/2022 2:34 PM, Scott Kitterman wrote:
>> That's nice.  How is it relevant to what I posted?
>>> They reparse the header and revalidate as needed when a user selects the mail.  While key management actions such as key rotation are formally outside the scope of RFC 6376, such things do happen and so the accuracy of time late verification does decline over time.  It might even be hazardous to attempt if the key size is small or the private key has been made available [1].
>> Same question.
> In theory DKIM can be (and has been) implementated in an MUA and it generally works reasonably well when a message is received, but AIUI (and maybe I don't) to be useful for Bimi such a verification would need to be reliable over time and I have yet to see it work that way despite it being (as you suggested) theoretically fine.
>
> For something like Bimi to be a reliable indicator of anything, I think both theory and practice need to be considered (even though they're in theory the same).


OK.  So I made some basic architectural points, noting a distinction 
from implementation choices and you commented on possible implementation 
issues.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net