[Dcrup] Re: [Editorial Errata Reported] RFC8463 (7930)

Orie Steele <orie@transmute.industries> Fri, 10 May 2024 19:43 UTC

Return-Path: <orie@transmute.industries>
X-Original-To: dcrup@ietfa.amsl.com
Delivered-To: dcrup@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFBB3C1D61F3 for <dcrup@ietfa.amsl.com>; Fri, 10 May 2024 12:43:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.085
X-Spam-Level:
X-Spam-Status: No, score=-2.085 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=transmute.industries
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id neog70F01ng7 for <dcrup@ietfa.amsl.com>; Fri, 10 May 2024 12:43:05 -0700 (PDT)
Received: from mail-pg1-x533.google.com (mail-pg1-x533.google.com [IPv6:2607:f8b0:4864:20::533]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37B2AC1D5C7E for <dcrup@ietf.org>; Fri, 10 May 2024 12:43:05 -0700 (PDT)
Received: by mail-pg1-x533.google.com with SMTP id 41be03b00d2f7-61c4ebd0c99so1561102a12.0 for <dcrup@ietf.org>; Fri, 10 May 2024 12:43:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=transmute.industries; s=google; t=1715370184; x=1715974984; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=XDHArKQTVyRFEJjcatSh+ZPuIr+PUpd6amU/JxOgmnA=; b=EmB4E3dmqPlknRh9ZXyTSVvXFiS0yDk43jWkx0rfyjWnfstVcdl0i05vuY5euil1bt uPPPtSK0oSCynpMU8eCxrCWDhEXbO6KNcd6iJyoUtLk11Xk3yMxwbxHaR59kJB+uYO6Y IELGikYV+95LQ/JUhJI+m1pe1XstQ7rqMUgruYrjmYeBb8tai7oBIl+y0cIaSp6GW15d NwP6pNhlI3vwCLdLyVaPGOU/Qzo1vwGDqs2d23UBGWYukZmaDdSzKJSKxZKeGI46WiTp 0E1f9w4/eauVqsmsLXZn5akmp1SAsJrDjkxNzmhy9PdjbkCKEfsistYM8BRcgBV2aKNK K5UQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715370184; x=1715974984; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=XDHArKQTVyRFEJjcatSh+ZPuIr+PUpd6amU/JxOgmnA=; b=rq1iSjriqxIQ4kst6bidvYx17N1CQeIxbwHBVG973Z1Bn07sfmkWOu1tZVH3NvPqUG xPi+fdbkJp9kPH9OOqxxE6W6ogaGkJ/TbyK32H6luoqoV8EoDq1GgzWHDpQlrk4Mb+fQ VZriefH7gR8WnuDi8cqwE/Q/I/Acl+tJ0PbbsRlseIa6lz5nnKuXBsTm8OeV0kqvL+CZ 8eeFFifE7LBW3fja503dBm8WCrwe01QeaPLJKvHcmG5M5VD2s4qAw36rOu6r3RzYnShh ZbhowPGeJ+QuL67ZBPUkXYBkW6WnA4Lu2IGeAN8xf67tOob3uW/pdfxjgbD1izg0V99U FlYg==
X-Forwarded-Encrypted: i=1; AJvYcCX5gPVP8mjAQ5cY4DLUNVLXwy4cob6yq/jmpUxoNwYd+nG+pNMyuGUatfEQ/lr8vhWmzgGGwgi0rCnRywy+UQ==
X-Gm-Message-State: AOJu0Yx6Pw3rg94s096k/33rIo8Ph7CE32u/0DeVxn6U2qkQKDhKsI/F sGl7DQaB5Tm9DoQ6/LeVtcrTAt9pFEVxcpv8AVCkRETFl2qITi9t+GdBW60mJ8J4qj831JR1ggq +PM62VpA3Rac0NykOIlDJuZA71xnO2P0mRd5Ccg==
X-Google-Smtp-Source: AGHT+IF2Sm0avHPPd2ljiINcPCPIm4KnxtI3/wcCoJ25zTA67cMwNX6OagXc+fPWeVElaOuvRLCXVzN1tWq1Psvzv00=
X-Received: by 2002:a17:90a:9b09:b0:2b3:79ad:856d with SMTP id 98e67ed59e1d1-2b6cd1e4f60mr3982501a91.48.1715370184567; Fri, 10 May 2024 12:43:04 -0700 (PDT)
MIME-Version: 1.0
References: <20240509203958.F19D933CD1@rfcpa.amsl.com> <55570A01-CF1B-4D47-B74A-D3BDBDD2E65E@amsl.com>
In-Reply-To: <55570A01-CF1B-4D47-B74A-D3BDBDD2E65E@amsl.com>
From: Orie Steele <orie@transmute.industries>
Date: Fri, 10 May 2024 14:42:53 -0500
Message-ID: <CAN8C-_KycC_9g5Tviawp8P4YDqzHAptzTiw=i10QhL9JtWouug@mail.gmail.com>
To: Rebecca VanRheenen <rvanrheenen@amsl.com>
Content-Type: multipart/alternative; boundary="000000000000828c0906181ebed9"
Message-ID-Hash: RBRMOZVDC4SZ4M4PRSHAKHLAKREKY3NN
X-Message-ID-Hash: RBRMOZVDC4SZ4M4PRSHAKHLAKREKY3NN
X-MailFrom: orie@transmute.industries
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dcrup.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "Murray S. Kucherawy" <superuser@gmail.com>, steffen@sdaoden.eu, standards@taugh.com, dcrup@ietf.org, RFC Editor <rfc-editor@rfc-editor.org>
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [Dcrup] Re: [Editorial Errata Reported] RFC8463 (7930)
List-Id: DKIM Crypto Update <dcrup.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dcrup/W4Rxo4WFGpSrlYM2DBxIHdTLpU8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dcrup>
List-Help: <mailto:dcrup-request@ietf.org?subject=help>
List-Owner: <mailto:dcrup-owner@ietf.org>
List-Post: <mailto:dcrup@ietf.org>
List-Subscribe: <mailto:dcrup-join@ietf.org>
List-Unsubscribe: <mailto:dcrup-leave@ietf.org>

I tried to verify the signature from the RFC, until I realized how
complicated DKIM signatures are, it seems like there is possibly a bug in
the implementation the report is using related to whitespace normalization?

This is probably one for Murray.

OS

On Fri, May 10, 2024 at 12:53 PM Rebecca VanRheenen <rvanrheenen@amsl.com>
wrote:

> Hi Murray and Orie,
>
> We are unable to verify this erratum that the submitter marked as
> editorial, so we changed the Type to “Technical”. As Stream Approver,
> please review and set the Status and Type accordingly (see the definitions
> at https://www.rfc-editor.org/errata-definitions/)
>
> Note that John Levine recommends rejecting this erratum.
>
> Also note that we are sending this to you as ADs of the ART area; the
> dcrup WG has concluded.
>
> You may review the report at:
> https://www.rfc-editor.org/errata/eid7930
>
> Information on how to verify errata reports can be found at:
> https://www.rfc-editor.org/how-to-verify/
>
> Further information on errata can be found at:
> https://www.rfc-editor.org/errata.php
>
> Thank you.
>
> RFC Editor/rv
>
>
> > On May 9, 2024, at 1:39 PM, RFC Errata System <rfc-editor@rfc-editor.org>
> wrote:
> >
> > The following errata report has been submitted for RFC8463,
> > "A New Cryptographic Signature Method for DomainKeys Identified Mail
> (DKIM)".
> >
> > --------------------------------------
> > You may review the report below and at:
> > https://www.rfc-editor.org/errata/eid7930
> >
> > --------------------------------------
> > Type: Editorial
> > Reported by: Steffen Nurpmeso <steffen@sdaoden.eu>
> >
> > Section: A.3
> >
> > Original Text
> > -------------
> > It is about the DKIM signature, baby, it is
> >
> >
> /gCrinpcQOoIfuHNQIbq4pgh9kyIK3AQUdt9OdqQehSwhEIug4D11BusFa3bT3FY5OsU7ZbnKELq+eXdp1Q1Dw==
> >
> > (even though this pastes terribly in this HTML)
> >
> > Corrected Text
> > --------------
> > The signature should be
> >
> >
> QGeDV9CRdXSybek0z54GoycZ4/kl1PsNnGoOsCZ0ZOOwiGYFE8Ft0SZpy1XLW/fwlwNFC1k6VaxsnQAH8+9cAA==
> >
> > Notes
> > -----
> > On the DKIM list i wrote
> >
> >> I come here because alongside the above i had a look at RFC 8463
> >> again, and its example in "A.3.  Signed Message".
> >> And if i use its "A.1.  Secret Keys", and (manually) normalize the
> >> example message header of A.3 via "relaxed"
> > [.]
> >> and pass that through RFC 8032 code:
> >
> >> privkey: b'nWGxne/9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A=\n'
> >> pubkey : b'11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=\n'
> >> The message is:
> >>>>> b'from:Joe SixPack <joe@football.example.com>\r\nto:Suzie Q <
> suzie@shopping.example.net>\r\nsubject:Is dinner ready?\r\ndate:Fri, 11
> Jul 2003 21:00:37 -0700 (PDT)\r\nmessage-id:<
> 20030712040037.46341.5F8J@football.example.com>\r\ndkim-signature:v=1;
> a=ed25519-sha256; c=relaxed/relaxed; d=football.example.com; i=@
> football.example.com; q=dns/txt; s=brisbane; t=1528637909; h=from : to :
> subject : date : message-id : from : subject : date;
> bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=; b='<<<
> >>
> >> then i get
> >>
> >> Signature:
> b'QGeDV9CRdXSybek0z54GoycZ4/kl1PsNnGoOsCZ0ZOOwiGYFE8Ft0SZpy1XLW/fwlwNFC1k6VaxsnQAH8+9cAA==\n'
> >> Signature verifies: True
> >
> > Instructions:
> > -------------
> > This erratum is currently posted as "Reported". (If it is spam, it
> > will be removed shortly by the RFC Production Center.) Please
> > use "Reply All" to discuss whether it should be verified or
> > rejected. When a decision is reached, the verifying party
> > will log in to change the status and edit the report, if necessary.
> >
> > --------------------------------------
> > RFC8463 (draft-ietf-dcrup-dkim-crypto-14)
> > --------------------------------------
> > Title               : A New Cryptographic Signature Method for
> DomainKeys Identified Mail (DKIM)
> > Publication Date    : September 2018
> > Author(s)           : J. Levine
> > Category            : PROPOSED STANDARD
> > Source              : DKIM Crypto Update
> > Stream              : IETF
> > Verifying Party     : IESG
> >
>
>

-- 


ORIE STEELE
Chief Technology Officer
www.transmute.industries

<https://transmute.industries>