[dmarc-ietf] WGLC ARC-16 concern on Section 5.1.2 - cv=fail should sign greedily

[Seth Blank <[e-mail]>]

https://tools.ietf.org/html/draft-ietf-dmarc-arc-protocol-16#section-5.1.2

Originally, even in the event of a chain validation failure, the Sealer's
ARC-Seal would sign all ARC header fields on the message.

When we introduced the concept of cv=invalid last year, the advice was to
only sign your own ARC Set, because there was no deterministic way to know
which header fields to sign when those ARC header fields were not properly
intact (the definition of invalid). We then decided to abandon the
cv=invalid path and only have cv=fail.

Somehow, in the current doc this advice for invalid chains now applies to
all chain failures. Section 5.1.2's title even mentions it is for the
invalid case, but the text as written applies to all failed chains.

Without the ARC Seal covering the ARC header fields in the failing chain,
all the data in the failed chain can be modified as it is not covered under
the latest signature.

The proper guidance should be that the ARC-Seal MUST sign the ARC Chain in
its entirety, unless that is structurally impossible, in which case it
should only sign itself.

I believe the proper text for this section (replacing the first paragraph
for 5.1.2 in its entirety) should be:

   In the event that it is not possible to generate a deterministic list of
previous
   ARC Sets to sign (such as when the chain undergoing validation
   is structurally invalid), the signature scope of the AS header field b=
   value MUST only include the latest ARC Set headers as if this newest ARC
   Set was the only set present.