Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Scott Kitterman <[e-mail]>]

On July 18, 2022 8:50:15 PM UTC, Dave Crocker <[e-mail]> wrote:
>On 7/18/2022 1:22 PM, Dave Crocker wrote:
>> IMAP and POP are examples of protocols created for MUAs.  They do not specify the way an MUA can/should implement these details or how things should be presented to users, but they very much dictate their realm of functionality.  That naturally pertains to some aspects of MUA design. 
>
>Addendum:
>
>DKIM is designed as an end-to-end mechanism.  Both ends can be implemented in MUAs.  There is nothing that dictates that any aspect of DKIM be implemented in the email handling infrastructure.  The choice to implement it in that infrastructure is operational, rather than architectural.
>
I think that's accurate, but not particularly helpful.

Typically MUAs (standalone ones anyway) don't store the results of operations like DKIM verification.  They reparse the header and revalidate as needed when a user selects the mail.  While key management actions such as key rotation are formally outside the scope of RFC 6376, such things do happen and so the accuracy of time late verification does decline over time.  It might even be hazardous to attempt if the key size is small or the private key has been made available [1].

Scott K

[1] https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/