Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Dave Crocker <[e-mail]>]

On 7/18/2022 2:13 PM, Scott Kitterman wrote:
> On July 18, 2022 8:50:15 PM UTC, Dave Crocker <[e-mail]> wrote:
>> On 7/18/2022 1:22 PM, Dave Crocker wrote:
>>> IMAP and POP are examples of protocols created for MUAs.  They do not specify the way an MUA can/should implement these details or how things should be presented to users, but they very much dictate their realm of functionality.  That naturally pertains to some aspects of MUA design.
>> Addendum:
>>
>> DKIM is designed as an end-to-end mechanism.  Both ends can be implemented in MUAs.  There is nothing that dictates that any aspect of DKIM be implemented in the email handling infrastructure.  The choice to implement it in that infrastructure is operational, rather than architectural.
>>
> I think that's accurate, but not particularly helpful.

Thanks for the helpful assessment.  If no one needed to hear the 
information that's fine.  From the postings, it wasn't clear to me.  The 
boundaries for interoperability and specification work can be confusing.


> Typically MUAs (standalone ones anyway) don't store the results of operations like DKIM verification.

That's nice.  How is it relevant to what I posted?


> They reparse the header and revalidate as needed when a user selects the mail.  While key management actions such as key rotation are formally outside the scope of RFC 6376, such things do happen and so the accuracy of time late verification does decline over time.  It might even be hazardous to attempt if the key size is small or the private key has been made available [1].

Same question.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net