Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Scott Kitterman <[e-mail]>]

On July 18, 2022 9:23:54 PM UTC, Dave Crocker <[e-mail]> wrote:
>On 7/18/2022 2:13 PM, Scott Kitterman wrote:
>> On July 18, 2022 8:50:15 PM UTC, Dave Crocker <[e-mail]> wrote:
>>> On 7/18/2022 1:22 PM, Dave Crocker wrote:
>>>> IMAP and POP are examples of protocols created for MUAs.  They do not specify the way an MUA can/should implement these details or how things should be presented to users, but they very much dictate their realm of functionality.  That naturally pertains to some aspects of MUA design.
>>> Addendum:
>>> 
>>> DKIM is designed as an end-to-end mechanism.  Both ends can be implemented in MUAs.  There is nothing that dictates that any aspect of DKIM be implemented in the email handling infrastructure.  The choice to implement it in that infrastructure is operational, rather than architectural.
>>> 
>> I think that's accurate, but not particularly helpful.
>
>Thanks for the helpful assessment.  If no one needed to hear the information that's fine.  From the postings, it wasn't clear to me.  The boundaries for interoperability and specification work can be confusing.
>
>
>> Typically MUAs (standalone ones anyway) don't store the results of operations like DKIM verification.
>
>That's nice.  How is it relevant to what I posted?
>
>
>> They reparse the header and revalidate as needed when a user selects the mail.  While key management actions such as key rotation are formally outside the scope of RFC 6376, such things do happen and so the accuracy of time late verification does decline over time.  It might even be hazardous to attempt if the key size is small or the private key has been made available [1].
>
>Same question.

In theory DKIM can be (and has been) implementated in an MUA and it generally works reasonably well when a message is received, but AIUI (and maybe I don't) to be useful for Bimi such a verification would need to be reliable over time and I have yet to see it work that way despite it being (as you suggested) theoretically fine.

For something like Bimi to be a reliable indicator of anything, I think both theory and practice need to be considered (even though they're in theory the same).

Nothing worth starting a big thread over, so I'll leave it here for people to consider (or not).

Scott K