Return-Path: X-Original-To: ietf-dkim@mail2.ietf.org Delivered-To: ietf-dkim@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 90DD12074B25 for ; Thu, 24 Apr 2025 00:15:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -2.798 X-Spam-Level: X-Spam-Status: No, score=-2.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=fastmailteam.com header.b="5AjLy60H"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="RP72TGpR" Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKsjaueZYgJ8 for ; Thu, 24 Apr 2025 00:15:09 -0700 (PDT) Received: from fhigh-a2-smtp.messagingengine.com (fhigh-a2-smtp.messagingengine.com [103.168.172.153]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id D20E22074B1B for ; Thu, 24 Apr 2025 00:15:09 -0700 (PDT) Received: from phl-compute-02.internal (phl-compute-02.phl.internal [10.202.2.42]) by mailfhigh.phl.internal (Postfix) with ESMTP id 9A32C11402CE; Thu, 24 Apr 2025 03:15:09 -0400 (EDT) Received: from phl-imap-16 ([10.202.2.88]) by phl-compute-02.internal (MEProxy); Thu, 24 Apr 2025 03:15:09 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= fastmailteam.com; h=cc:content-type:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm1; t=1745478909; x= 1745565309; bh=5rU8M0y1OvUjTfjU7WPJuSk+9INUhkhUa0tJkyXzDr4=; b=5 AjLy60HXm6vvM0cQC2LDWHRzrkiX/KOpfG1YNChJP+ZV4xXyD8zVHDb8LdkqEJX9 TJwk8UyGj/jHrjTLFYXej5l0dnJqCvoRmeSEIy9y5F9jNsJXLCMLgBxTnh30OrJG XV4neUfcI1/6KckD+EQIY6G3FL22au6BEeeG5yzlgkD1HTnsi68mQGiMa0npYWUP Ss096RS6A7rthkHyCwJYY5NI6MBBgDRhnJVpFt+hrMevlKH8UXRuIEI8KUn5+m0C rNTE9ipGzzxEdYIr3EzpXiyGJRz5c2tLEBekBJq55VqSv2D6Pgn9tYhCi3074gAB 2kVQCMtA89UU5DbE7PXNw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1745478909; x=1745565309; bh=5rU8M0y1OvUjTfjU7WPJuSk+9INUhkhUa0t JkyXzDr4=; b=RP72TGpRscPEMa9teGX/2LzJwsxgtRAJdO90Gc0PFhHXDJjsjpy R1eG50dCmy/Bsknn7EMiXiQNmCi9S4Dkk7U6o2q11SEre1PYKrBBpoojeBae9EWH cXC2J+gDYTwMcpGRGOC/4f4Ah9VgWN0lwlS+nbW6gtkx+cHppp5K5ssYYwVn6Ub1 3V2n65haXylkHGXK4br7rfvC31mX+IVM+cGkBsD1yqvTCDb687Pk4IPILVrr9SAT pKfBsokulpBJqSthzgRjjQIF5T107HmJUueRA2Bo7VsFYVW84iJRKQ+6fMlBYXkL v7P1aZPBQt8ryAjIMOkLrXGaLOaW3oM5I5A== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvgeekkeegucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpih gvnhhtshculddquddttddmnecujfgurhepofggfffhvffkjghfufgtsegrtderreertddt necuhfhrohhmpedfuehrohhnucfiohhnugifrghnrgdfuceosghrohhnghesfhgrshhtmh grihhlthgvrghmrdgtohhmqeenucggtffrrghtthgvrhhnpeefveejveekudekffffveev ueetfeehuedufefftefggefhheelteelgeeghefftdenucevlhhushhtvghrufhiiigvpe dtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegsrhhonhhgsehfrghsthhmrghilhhtvggr mhdrtghomhdpnhgspghrtghpthhtohepfedpmhhouggvpehsmhhtphhouhhtpdhrtghpth htohepuggtrhhotghkvghrsegssghifidrnhgvthdprhgtphhtthhopehivghtfhdrohhr ghesfhgrhhhqvddrtghomhdprhgtphhtthhopehivghtfhdqughkihhmsehivghtfhdroh hrgh X-ME-Proxy: Feedback-ID: i2d7042ce:Fastmail Received: by mailuser.phl.internal (Postfix, from userid 501) id 25A102CC006A; Thu, 24 Apr 2025 03:15:09 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface MIME-Version: 1.0 X-ThreadId: T3a995f8af6e24367 Date: Thu, 24 Apr 2025 03:14:46 -0400 From: "Bron Gondwana" To: "Dave Crocker" , "Larry M. Smith" , ietf-dkim@ietf.org Message-Id: In-Reply-To: <1e14f1ae-2797-479a-805c-a28c66a12a60@dcrocker.net> References: <1e14f1ae-2797-479a-805c-a28c66a12a60@dcrocker.net> Content-Type: multipart/alternative; boundary=a23062d88f954b9caf753f455a6d4806 Message-ID-Hash: OR22XACIO6F6HQCEAIJENZTOABX2ZE35 X-Message-ID-Hash: OR22XACIO6F6HQCEAIJENZTOABX2ZE35 X-MailFrom: brong@fastmailteam.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ietf-dkim.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BIetf-dkim=5D_Re=3A_My_concerns?= List-Id: IETF DKIM List Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --a23062d88f954b9caf753f455a6d4806 Content-Type: text/plain Content-Transfer-Encoding: 7bit On Sun, Apr 20, 2025, at 02:50, Dave Crocker wrote: > I believe there is something approximating rough consensus that simply > including the original recipient address in the DKIM signature, and > validating it by the receiver, should be enough to suppress DKIM Replay. Certainly not consensus on that point as stated here. Not unless you discount alumni forwarders and mailing lists; or expect them to all add a DKIM signature as well. Adding the original recipient address certainly helps a lot, but it still doesn't allow you to get two messages and know if they're a replay or not. The design I co-authored (once all involved parties support it) gives 100% certainty which signing domain split the message into multiple copies, if you receive two messages with the same i=1 first signature. So you know where the replay occurred. Bron. -- Bron Gondwana, CEO, Fastmail Pty Ltd brong@fastmailteam.com --a23062d88f954b9caf753f455a6d4806 Content-Type: text/html Content-Transfer-Encoding: quoted-printable
On Sun, Apr 20, 2025, at 02:50, Dave Crocker wrote:
I believe there is something approximating rough consensus th= at simply 
including the ori= ginal recipient address in the DKIM signature, and 
validating it by the receiver, should be enough = to suppress DKIM Replay.

Certainly not consensus= on that point as stated here.  Not unless you discount alumni forw= arders and mailing lists; or expect them to all add a DKIM signature as = well.

Adding the original recipient address certainly helps a= lot, but it still doesn't allow you to get two messages and know if the= y're a replay or not.

The des= ign I co-authored (once all involved parties support it) gives 100% cert= ainty which signing domain split the message into multiple copies, if yo= u receive two messages with the same i=3D1 first signature.  So you= know where the replay occurred.
=
Bron.

--
  Bron Gondwana, CEO, Fastmail= Pty Ltd
  brong@fastmailteam.com


--a23062d88f954b9caf753f455a6d4806--