Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Scott Kitterman <[e-mail]>]

On July 19, 2022 6:03:10 PM UTC, Dave Crocker <[e-mail]> wrote:
>On 7/18/2022 2:13 PM, Scott Kitterman wrote:
>> Typically MUAs (standalone ones anyway) don't store the results of operations like DKIM verification.  They reparse the header and revalidate as needed when a user selects the mail.  While key management actions such as key rotation are formally outside the scope of RFC 6376, such things do happen and so the accuracy of time late verification does decline over time.  It might even be hazardous to attempt if the key size is small or the private key has been made available [1].
>On 7/18/2022 2:34 PM, Scott Kitterman wrote:
>> In theory DKIM can be (and has been) implementated in an MUA and it generally works reasonably well when a message is received, but AIUI (and maybe I don't) to be useful for Bimi such a verification would need to be reliable over time and I have yet to see it work that way despite it being (as you suggested) theoretically fine.
>> 
>> For something like Bimi to be a reliable indicator of anything, I think both theory and practice need to be considered (even though they're in theory the same).
>
>
>Considering your comments a bit further, it appears you are suggesting that BIMI does not need to validate at the time of display.

Maybe.  I won't claim to have been following the details closely enough to have an opinion.  For underlying authentication methods, such as DKIM, I think it's critical to evaluate them at the time of receipt and store the results.  That might also be true of Bimi, but I don't know.

Scott K