[Dcrup] Re: [Editorial Errata Reported] RFC8463 (7930)

"Murray S. Kucherawy" <superuser@gmail.com> Fri, 10 May 2024 19:55 UTC

Return-Path: <superuser@gmail.com>
X-Original-To: dcrup@ietfa.amsl.com
Delivered-To: dcrup@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34EFFC15792A for <dcrup@ietfa.amsl.com>; Fri, 10 May 2024 12:55:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.084
X-Spam-Level:
X-Spam-Status: No, score=-2.084 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I5pMhx_DFOHt for <dcrup@ietfa.amsl.com>; Fri, 10 May 2024 12:55:48 -0700 (PDT)
Received: from mail-ej1-x62a.google.com (mail-ej1-x62a.google.com [IPv6:2a00:1450:4864:20::62a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0760EC1519B7 for <dcrup@ietf.org>; Fri, 10 May 2024 12:55:48 -0700 (PDT)
Received: by mail-ej1-x62a.google.com with SMTP id a640c23a62f3a-a59cac06ec3so61142966b.0 for <dcrup@ietf.org>; Fri, 10 May 2024 12:55:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1715370946; x=1715975746; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=dE9I57Yd7lsS2iV0hpjjz9Kyy9Mtgs4znL+GG4gJgYE=; b=fk7+lOoBUFv8C0hpwkenXe46MDkpig/zqe/kc4ytI352DUr/CCCFcsVCfOUWjwu5Ez p15cgneKsVg1N+xQcPc8kpHQDTCCZ089f91BuCmfBY967+sA3OQcGgT1h3oMWuFqEnjn uwUw3xr013T74cWZBmlUzhWN3X1MkCY/nHUD4ODL1aKI51CSB038gGUpMpS7wKRm3PB3 2PcUdcHVbsX3aOGSpSeg9zER3d0+qZuM2l/J69RDkYCEESDvsbVIM48vw4KBvZO+cnOe fRVqGxgyj+HcnJBlquNXRiE07gOuvnKaXY78zM5icS4WtclZu/qivnvL9GV9jW4cZZLh OsHA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715370946; x=1715975746; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=dE9I57Yd7lsS2iV0hpjjz9Kyy9Mtgs4znL+GG4gJgYE=; b=Ytt6hP2M7rQBftuIDGWgG0R2NF7zMna4QCEWbhhDqGwwVV7KpqSi9EqAB3ZV+OleeB ttQXVoLvcLJFuhiztTSI8yiYhSTHC6MAv/oGI5H2p7m/4MCH2gmbsf32jU5MeBUI7w+r uukJ6Nd+LOgmm27pcNSkBr4Y9GD9NQugu1/aa/sxnofTtc/uY6MsxuZYG2zQ5Za13SK5 sLab1L8M87byjRFM4vSEcJnQ6fZqW+bROkghIw/+QOlc8pIlYlfDUmELzko74IaDn7dg U3xJmCOiuSU6eLgvj1iIsr+0OPVyC9k2HU1N8ifZUsHqFSC5i28JrDzuzycyNmhaVbC1 KW1w==
X-Forwarded-Encrypted: i=1; AJvYcCV4O/SpeMnXblHDMaLocEOgNUsfV7myXE9u2JHm+Av3hbYhhx9nqETNhsWk6wRo2cKhnPZSn51SLkXD1wKnrg==
X-Gm-Message-State: AOJu0Yzp0awAWewPHFXA4q/kSyKSbB4KvnK6xwbsAuqqU6mZ9ui13dvv gnaroOV5W4+dl4g1gUKca+xzjOUnWGbT/u5j3NM9oxftb2duMoyqLvo0IvRrTakbGvECh+HpCrY oUYPwHYScn2dMb4WvXKKeE1K7pNQ=
X-Google-Smtp-Source: AGHT+IEQugtVH0ArU1vcs+wAN/Ey4f95zqsN71kmg/RxGY+b4KpzvdLBDo2IzGa9gvyDFpAAT0xBsIKXBclJP5E6ZhI=
X-Received: by 2002:a17:906:d972:b0:a5a:1561:ba52 with SMTP id a640c23a62f3a-a5a2d6e2b1cmr206235166b.7.1715370946068; Fri, 10 May 2024 12:55:46 -0700 (PDT)
MIME-Version: 1.0
References: <20240509203958.F19D933CD1@rfcpa.amsl.com> <55570A01-CF1B-4D47-B74A-D3BDBDD2E65E@amsl.com> <CAN8C-_KycC_9g5Tviawp8P4YDqzHAptzTiw=i10QhL9JtWouug@mail.gmail.com>
In-Reply-To: <CAN8C-_KycC_9g5Tviawp8P4YDqzHAptzTiw=i10QhL9JtWouug@mail.gmail.com>
From: "Murray S. Kucherawy" <superuser@gmail.com>
Date: Fri, 10 May 2024 12:55:33 -0700
Message-ID: <CAL0qLwZ0KYzbMRVfizwc4uKZEVN19C4UoWj8=pK5viT2i4PW+w@mail.gmail.com>
To: Orie Steele <orie@transmute.industries>
Content-Type: multipart/alternative; boundary="000000000000e6082e06181eeb9b"
Message-ID-Hash: NNCRX7HJKVQO4H3IHTUG4Y6GEIRPL5DG
X-Message-ID-Hash: NNCRX7HJKVQO4H3IHTUG4Y6GEIRPL5DG
X-MailFrom: superuser@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dcrup.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Rebecca VanRheenen <rvanrheenen@amsl.com>, steffen@sdaoden.eu, standards@taugh.com, dcrup@ietf.org, RFC Editor <rfc-editor@rfc-editor.org>
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [Dcrup] Re: [Editorial Errata Reported] RFC8463 (7930)
List-Id: DKIM Crypto Update <dcrup.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/GW79m0AYL1sfUOCBtusbzvijoMQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dcrup>
List-Help: <mailto:dcrup-request@ietf.org?subject=help>
List-Owner: <mailto:dcrup-owner@ietf.org>
List-Post: <mailto:dcrup@ietf.org>
List-Subscribe: <mailto:dcrup-join@ietf.org>
List-Unsubscribe: <mailto:dcrup-leave@ietf.org>

Yep, this one's mine.

-MSK

On Fri, May 10, 2024 at 12:43 PM Orie Steele <orie@transmute.industries>
wrote:

> I tried to verify the signature from the RFC, until I realized how
> complicated DKIM signatures are, it seems like there is possibly a bug in
> the implementation the report is using related to whitespace normalization?
>
> This is probably one for Murray.
>
> OS
>
> On Fri, May 10, 2024 at 12:53 PM Rebecca VanRheenen <rvanrheenen@amsl.com>
> wrote:
>
>> Hi Murray and Orie,
>>
>> We are unable to verify this erratum that the submitter marked as
>> editorial, so we changed the Type to “Technical”. As Stream Approver,
>> please review and set the Status and Type accordingly (see the definitions
>> at https://www.rfc-editor.org/errata-definitions/)
>>
>> Note that John Levine recommends rejecting this erratum.
>>
>> Also note that we are sending this to you as ADs of the ART area; the
>> dcrup WG has concluded.
>>
>> You may review the report at:
>> https://www.rfc-editor.org/errata/eid7930
>>
>> Information on how to verify errata reports can be found at:
>> https://www.rfc-editor.org/how-to-verify/
>>
>> Further information on errata can be found at:
>> https://www.rfc-editor.org/errata.php
>>
>> Thank you.
>>
>> RFC Editor/rv
>>
>>
>> > On May 9, 2024, at 1:39 PM, RFC Errata System <
>> rfc-editor@rfc-editor.org> wrote:
>> >
>> > The following errata report has been submitted for RFC8463,
>> > "A New Cryptographic Signature Method for DomainKeys Identified Mail
>> (DKIM)".
>> >
>> > --------------------------------------
>> > You may review the report below and at:
>> > https://www.rfc-editor.org/errata/eid7930
>> >
>> > --------------------------------------
>> > Type: Editorial
>> > Reported by: Steffen Nurpmeso <steffen@sdaoden.eu>
>> >
>> > Section: A.3
>> >
>> > Original Text
>> > -------------
>> > It is about the DKIM signature, baby, it is
>> >
>> >
>> /gCrinpcQOoIfuHNQIbq4pgh9kyIK3AQUdt9OdqQehSwhEIug4D11BusFa3bT3FY5OsU7ZbnKELq+eXdp1Q1Dw==
>> >
>> > (even though this pastes terribly in this HTML)
>> >
>> > Corrected Text
>> > --------------
>> > The signature should be
>> >
>> >
>> QGeDV9CRdXSybek0z54GoycZ4/kl1PsNnGoOsCZ0ZOOwiGYFE8Ft0SZpy1XLW/fwlwNFC1k6VaxsnQAH8+9cAA==
>> >
>> > Notes
>> > -----
>> > On the DKIM list i wrote
>> >
>> >> I come here because alongside the above i had a look at RFC 8463
>> >> again, and its example in "A.3.  Signed Message".
>> >> And if i use its "A.1.  Secret Keys", and (manually) normalize the
>> >> example message header of A.3 via "relaxed"
>> > [.]
>> >> and pass that through RFC 8032 code:
>> >
>> >> privkey: b'nWGxne/9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A=\n'
>> >> pubkey : b'11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=\n'
>> >> The message is:
>> >>>>> b'from:Joe SixPack <joe@football.example.com>\r\nto:Suzie Q <
>> suzie@shopping.example.net>\r\nsubject:Is dinner ready?\r\ndate:Fri, 11
>> Jul 2003 21:00:37 -0700 (PDT)\r\nmessage-id:<
>> 20030712040037.46341.5F8J@football.example.com>\r\ndkim-signature:v=1;
>> a=ed25519-sha256; c=relaxed/relaxed; d=football.example.com; i=@
>> football.example.com; q=dns/txt; s=brisbane; t=1528637909; h=from : to :
>> subject : date : message-id : from : subject : date;
>> bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=; b='<<<
>> >>
>> >> then i get
>> >>
>> >> Signature:
>> b'QGeDV9CRdXSybek0z54GoycZ4/kl1PsNnGoOsCZ0ZOOwiGYFE8Ft0SZpy1XLW/fwlwNFC1k6VaxsnQAH8+9cAA==\n'
>> >> Signature verifies: True
>> >
>> > Instructions:
>> > -------------
>> > This erratum is currently posted as "Reported". (If it is spam, it
>> > will be removed shortly by the RFC Production Center.) Please
>> > use "Reply All" to discuss whether it should be verified or
>> > rejected. When a decision is reached, the verifying party
>> > will log in to change the status and edit the report, if necessary.
>> >
>> > --------------------------------------
>> > RFC8463 (draft-ietf-dcrup-dkim-crypto-14)
>> > --------------------------------------
>> > Title               : A New Cryptographic Signature Method for
>> DomainKeys Identified Mail (DKIM)
>> > Publication Date    : September 2018
>> > Author(s)           : J. Levine
>> > Category            : PROPOSED STANDARD
>> > Source              : DKIM Crypto Update
>> > Stream              : IETF
>> > Verifying Party     : IESG
>> >
>>
>>
>
> --
>
>
> ORIE STEELE
> Chief Technology Officer
> www.transmute.industries
>
> <https://transmute.industries>
>