IETF Logo Mail Archive

Re: [dmarc-ietf] spec nit - which DKIM to report

Alessandro Vesely <vesely@tana.it> Sat, 06 July 2019 11:30 UTC

Return-Path: <vesely@tana.it>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BEC312015A for <dmarc@ietfa.amsl.com>; Sat, 6 Jul 2019 04:30:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.3
X-Spam-Level:
X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1152-bit key) header.d=tana.it
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CPPNzy4NBTLG for <dmarc@ietfa.amsl.com>; Sat, 6 Jul 2019 04:30:18 -0700 (PDT)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82BE612009C for <dmarc@ietf.org>; Sat, 6 Jul 2019 04:30:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=delta; t=1562412615; bh=qXK2Q7inchwyfogbQ7N3h1BcMZbdBSATrMxKBe2Xj08=; l=1320; h=To:References:From:Date:In-Reply-To; b=BqTDjXIqFJZq+Io81mjVDoC4l92JDJ58nQpn7Ierzj4iREdpO5tYujQ14oUoUUA5l qF2OkWpY/8W+idgEznPglUDQsex02hPrj5inOKwI1N7FxCUC8Gbk0v9DW3RilVcHJ3 oiQ0hWLL7chDk+Lby7Jj6/0o31FZYlSp0smFRd81CFMqjO3XwrnjhshkHxhld
Authentication-Results: tana.it; auth=pass (details omitted)
Received: from [192.168.1.100] ([5.170.8.185]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1.2, 128bits, ECDHE-RSA-AES128-GCM-SHA256) by wmail.tana.it with ESMTPSA id 00000000005DC073.000000005D208647.0000440E; Sat, 06 Jul 2019 13:30:15 +0200
To: dmarc@ietf.org
References: <20190621184626.AE1B52016298ED@ary.qy>
From: Alessandro Vesely <vesely@tana.it>
Openpgp: preference=signencrypt
Autocrypt: addr=vesely@tana.it; prefer-encrypt=mutual; keydata= mQGiBERgr1sRBACwT8eXxGVWwVO+TvHEcvIe2nNlefi05FabcYoPkiVouDtbErExjoCK7FdM BRz+KjZcC8flOJmFR6rn48jcvgIZoCo0V5JuhgYFI2pWO17e6vECutHK09mnt5kLG/RwbiTZ cP8gjZtstH//Ff5x7hfQ9gSl7E/8flSV1Z0VOrJOBwCg7UPuSxYYPeHisH2L81LzR2gHUxME AKotfy9AoW5L1O9OSoIrBHzfevpA/fiuWWyV+6M887vfPCV6amZi2D5qaib89nce2H8g+9xP dppfccNlgekp0Qh3j7HKUy5WLCfz7b8Gpl5VYu2C7qhltiKBcK79gQnUDjB5zBHXgS0qLhJK YWEooQdIfFeNMYWPIp82J6i+QvsRBACG0eycR4HCRHQvw3vEnwSbRKs5YQlZjJJRSy9lA6U/ uF0bHXw9hrZervYZ25KSI5iFFNczwPkE3gKiTKabErSeBGqDS3q1QgZ1wKhQIGEgWuPRih0J KRdgFBVCWnfZ2UZY1ZpQ01raurYY/nYX4dquh8vA/PuFr/Y3dnbeHdvC0bQiQWxlc3NhbmRy byBWZXNlbHkgPHZlc2VseUB0YW5hLml0PohZBBMRAgAZBQJEYK9cBAsHAwIDFQIDAxYCAQIe AQIXgAAKCRC2rPREkNF8ABRIAJ9hqzo3j2eP4DCkkQa/BViMvvyQLQCeJnHZBThL90if5HmP trzr/BTXoIG5AQ0ERGCvbxAEAI0puriz27jNGsUhWuOyv7M6jChanXFIhMHKXR/3Bfi1YMj5 I2ki4V24k+PIAUXs7K8Yro5KTRcyZyJFaeFjsNwruPlgGCu7ZYvmsGDOgH6vjFv8aDgvujCn 3OQdBSygtylihlQUHFyQkRCjBp0EM2DE96+ulSitqzuZCaDl6e1HAAMFA/wIWsRwIE5kh4zE LlxNfa+fSirrQcniW95XSBAcUymS9GLlqcp2GqoJSYXTmspaVa27rMqrthtytvAEdY2D9KYt GtjajcQhYJQ612sVLwrVnqITeyg+L7b2s4m73gVx+X824dDEsoJldirH9LaZNRulTnUD1wcW Ey5G7kj0LykDLIhGBBgRAgAGBQJEYK9vAAoJELas9ESQ0XwAqgIAnjK+fFoGeBqyh6nuGqho obid1JbfAKCC5mETnzHYaw/Xk4rCcthv7AC5JLkBDQRYw+3UAQgA7M19L6F7IawBKQaxIx/f akrp1++lrbo54xFc4y2aHbGfhNkVGdMyKCZVkbZbAacW9j8As4g1xpqkOGeZ9/mDzATyEVew HKJtxkgZSUwkoVjcPIC/564NLJrAihZ2tPQdlsakIOPRy7NCVlNt3ziZojKLyPTHzh22jcdv Bv6PbPuVw3MbrfJbV1Hd7AQz8aPGSgs+Tit8EeGpXhZotd27ieSzM8FnHNu+skf5GrXSe8kZ keQdG3587E2n2BvSdGlSjtsQKmuUgAvrPVkIb9iPAzM23T0mj3k6t3iU57TcwIqdolTOUaB8 WjU2nTs+Jm+4d2UmP0fYLAoBHyxzV2PU/wARAQABiQFoBBgRAgAJBQJYw+3UAhsCASkJELas 9ESQ0XwAwF0gBBkBAgAGBQJYw+3UAAoJEA4nko8kG00g474H/204JJD4Ohqvs9Vdv8SLkesr ShXqqYsEhPcsjNwMIY23HXuIxpZbn2/BPOjpHAYprJPmS+tYwlc4C18WEeuDRllabAV8a02y xsCOzq7GUBjx7ee13xZkcKBZHBhyW/U3WH47LIuHQfGKaAPoLN0OGoJV4Y0jug3Pz9ZeIPf9 O70trFvZqMCoaQRH5dPrzrtHYPlv76AR9ctk5WuVg2mjsIgLoV2CVzIDyoVBrb8TPzl9S8Nl KAhuczvxvUoZnvfqzv/BhnSqxGXeGfE+FNQKp6Rt+Cztca2O4LGvRmAcIxV4obF9Qd2N1xb3 nKX9PvlAK7sl6LVqwqHzuA8/686oNqRotwCfcbWzsJDmzEA0kHBHTh7OwRis/XEAn1NChbfo u3F+/Ipg/XHiA/WV4bubuQINBFwOoIQBEADgJ8t4TSiLyRpRd3L6Oy5ezajwkPXG/rvKK8OY YtNy4s3jzrbasm8lq0fIFc12FNqjI+rYiyrVAx2sxv3yVT2MWlFdfpZiNEGS+0tYBim006cc ta3WNoN69PKtPK5t1tpBrhCDMcQwPw2o00WBDvVHJi0zg7HQ9m2c0Hzo2AUTdy7h4vQRyI9K EjhCxVRlBOVZCmKnf2iad/0xHpLz9hjqh3P2mpby8DEw0wEOMCwhABO/GVjBUbxuTwHC1D9F DI7tF7L2+WuKqjHhFonS4Q8QE8nI3IGLhazIe0xpgDSNOFUIpGN5v31Wl8OCQ7tLmc/xR2Pi JD3pdIRevjlAijDLyLx6d3vk3bfA73KtEU/rpmJmWowPWG/P278bvO/xHe1rluYWeXqOOZmy 5CikxeNZ6nTd+Tcd/XPhjusy0bJMwAVoNoxgk6FZyBN4+/zWiEezDSj59gwqSzLnOW8i2WCe 4lJoyP3+A0/mg+PR/2WN1Rg4GfGsHjRgPA+NcfsGaoPRla3eHJ9ALDovaL0HmDGZHEnhqP8O ooEKlrQ3L+SV6Pb4/2S0QNYXLP8rD6YySKSH0Trq/dZ78IWtiHFWWQXgZ3S4XtfZ1txlj2GQ a4EaIrtxcmjN/zmEXaRBDqkcyshJOAQExKt6r7Ig0OKDLPJtuohdz2vi2krqYC4LLdoDjwAR AQABiEkEGBECAAkFAlwOoIQCGwwACgkQtqz0RJDRfACNAACeKreSOjkf3BxAL9dnGeYso2e3 sTsAoL4J4GC64/eh1VthLGkUOWBY2IQN
Message-ID: <233c41a5-4072-266c-54eb-e19239949c4a@tana.it>
Date: Sat, 06 Jul 2019 13:30:13 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2
MIME-Version: 1.0
In-Reply-To: <20190621184626.AE1B52016298ED@ary.qy>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/eat8nbWQnELTtq8Mi_HH1T-hjzk>
Subject: Re: [dmarc-ietf] spec nit - which DKIM to report
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 06 Jul 2019 11:30:20 -0000

>> the spec does not define *which* DKIM signature should be reported in 
>> the DMARC RUA created by a receiver.
>> [... skip proposed order ...]
> 
> This seems overcomplex.  How about saying the reports SHOULD include
> all valid DKIM reports.  If they can't, they can't, and I don't see
> any benefit in offering advice on how not to comply.


In my implementation, I have two points where I don't comply:

*Maximum signatures in a message*

That is to avoid silly attacks (but consider the recent SKS attack).  It
is about 1000, IIRC.  The rest is not verified.


*Maximum signatures reported in rua*

This is much lower, currently 4.  It's there because transitive closure
is not yet available on a number of SQL products.  In particular,
MariaDB needs 10.2.2[*], which is not yet in Debian stable.  The
workaround is to left joint a (finite) number of times the table with
itself[†].


How about this:

    In the presence of multiple signatures, aggregate reports SHOULD
    mention at most 1000 and at least 4 signatures (if available), in
    order of decreasing importance.

?


Best
Ale
-- 

[*]
https://mariadb.com/kb/en/library/recursive-common-table-expressions-overview/

[†] search db_sql_dmarc_agg_record in:
https://www.tana.it/svn/zdkimfilter/tags/v1.6/odbx_example.conf

v2.23.0 | Report a Bug | By Email