Re: [secdir] Review of draft-ietf-marf-dkim-reporting-11

["Murray S. Kucherawy" <[e-mail]>]

> -----Original Message-----
> From: Tero Kivinen [mailto:[e-mail]]
> Sent: Friday, March 09, 2012 3:53 AM
> To: Murray S. Kucherawy
> Cc: [e-mail]; [e-mail]; [e-mail]
> Subject: RE: Review of draft-ietf-marf-dkim-reporting-11
> 
> > How does that look?
> 
> That looks very clear and good...

OK, it's in the version I'll post when LC closes.

> > 8.3.  Unreported Fraud
> >
> >    An attacker can craft fraudulent DKIM-Signature fields on messages,
> >    without using "r=" tags, and avoid having these reported.  The
> >    procedure described in Section 3.3 does not permit the detection and
> >    reporting of such cases.
> 
> I think it might be useful to point out here that this whole mechanism
> does not really work agains attack, but is more useful detecting
> misconfigurations or errors in setup, because of attacker can do what
> is desribed above...

It does work where there's an attack in progress, with the caveat that asking for reports about the attack could produce a huge amount of feedback.  But I think the text we've landed on spells that out.

> >    It might be useful to some Signers to receive such reports, but the
> >    mechanism does not support it.  To offer such support, a Verifier
> >    would have to violate the first step in the algorithm and continue
> 							  ^^^
> 
> Add reference to section 3.3 (i.e. ... in the algorithm described in
> section 3.3 and continue ...). Or use single term (either procedure or
> algorithm) describing it. Now you have first paragraph talking about
> the procedure described in section 3.3, and then the next paragraph
> talks about the algorithm with out specifying which algorithm...

Right; changed the first one to "procedure".

Thanks,
-MSK