Re: [dmarc-ietf] Looking for degrees of freedom with Intermediaries - Effort and Policy

[Terry Zink <[e-mail]>]

I think we’re making progress here. So, a message would look like this:

From: [e-mail]
Authentication-Results: spf=pass (sender IP is xx.xx.xx.xx) smtp.mailfrom=mlm.example;
    dkim=fail (invalid body hash) header.d=authordomain.example
    dkim=pass (signature was verified) header.d=authordomain.example;
    dkim=pass (signature was verified) header.d=mlm.example;
    dmarc=pass header.from=authordomain.example (action=none cd=mlm.example)
DKIM-Signature: v=1; d=authordomain.example; s=selector; ...
DKIM-Signature: v=2; d=authordomain.example; s=selector; !cd=mlm.example; l=0; t=<now+30 seconds>
DKIM-Signature: v=1; d=mlm.example; s=foobar; ...
Some questions:


1.       This should be resistant to a replay attack 12 hours in the future because the “t=<now+30 seconds>” is part of the DKIM signature for v=2, and if a phisher copy/pastes it and changes “v=2” to “v=1”, the “t= “ part will be long past. Right?


2.       This will be susceptible to a replay attack for 30 seconds after initially sending it out, but only to the mailing list. Right?


3.       Verifiers need to know (enforce?) that a DKIM signature of “v=2 !cd=<blah>” is not enough to verify a real signature without the corresponding “v=1 d=<blah>” additional DKIM signature. In other words “v=2 !cd=<blah>” is useless unless paired with something else. Right?


4.       How should reputation engines accrue this message? To authordomain.example (the one in the header.from)? Or to mlm.example, the one in the smtp.mailfrom and DKIM d= domain that contained the strong signature?


5.       Verifiers will need to check at least 3 DKIM signatures. Is there a limit on the amount of signatures they should check? Presumably we wouldn’t want a verifier to check 30 signatures.


6.       What is the proposed t= time limit? Is 30 seconds enough? Too long? Too little?

-- Terry

From: Murray S. Kucherawy [mailto:[e-mail]]
Sent: Tuesday, May 19, 2015 11:39 AM
To: Terry Zink
Cc: Scott Kitterman; [e-mail]
Subject: Re: [dmarc-ietf] Looking for degrees of freedom with Intermediaries - Effort and Policy

On Tue, May 19, 2015 at 11:24 AM, Terry Zink <[e-mail]<mailto:[e-mail]>> wrote:
> Sure, but can it just be in a comment if you find that useful, or is it necessary to
> make that fact something a consumer of the field can parse out?
Putting it into a comment is fine, maybe something like “dmarc=pass action=none header.from=<domain.com<http://domain.com>> conditional.to<http://conditional.to>=<mailinglist.net<http://mailinglist.net>>”. I think it’s permissible to add additional fields like that into A-R, isn’t it?

More like:
dmarc=pass header.from=<domain> (action=<foo>, cd=<domain2>)
 > I've always found the details of how it came to that conclusion to be of only secondary interest

I agree with the reasons you outline, but when debugging and troubleshooting potentially tens, hundreds, or thousands of messages per day, it’s no longer secondary. It’s also easier to collect statistics on how many messages are conditionally passing DMARC and what mailing list or forwarder it is attached to.

You can create whatever structure you want in the comment (between parentheses).
-MSK