Re: [dmarc-ietf] WGLC ARC-16 concern on Section 5.1.2 - cv=fail should sign greedily

[Bron Gondwana <[e-mail]>]

On Sat, Jul 28, 2018, at 03:29, Seth Blank wrote:
> On Fri, Jul 27, 2018 at 10:21 AM, Murray S. Kucherawy
> <[e-mail]> wrote:>> On Fri, Jul 27, 2018 at 8:35 AM, Seth Blank
>> <[e-mail]> wrote:>> 
>>> The verification algorithm is straightforward. If you receive a
>>> chain that ends with cv=fail stop your evaluation, you’re done.
>>> There’s no separate validation path here.>> 
>> 
>> Then why bother signing anything when you affix "cv=fail"?
> 
> Because adding your ARC Seal over the chain guarantees that the
> receiver has a complete list of everyone who modified the message up
> until the failure.
No, this is wrong.  I have detailed why this is wrong many times.  A
single cv=fail means that there's no proof that the entire previous
chain isn't just a valid set of ARC headers picked up from somewhere
else with the serial numbers filed off and the entire message replaced
with something else.
The only thing your ARC Seal will validate is your own ARC-Authentication-
Results header - which isn't nothing (it could contain the IP address
that you received this message from) - but if SPF / DKIM and ARC are
all fails in your Authentication-Results, any earlier ARC and DKIM
headers have no provable causal relationship with the rest of the
message you received.
Bron.

--
  Bron Gondwana, CEO, FastMail Pty Ltd
  [e-mail]