Re: [secdir] Review of draft-ietf-marf-dkim-reporting-11

[Barry Leiba <[e-mail]>]

>   The presence of the DNS record that indicates willingness to accept
>   reports opens the recipient to abuse.  In particular, it is possible
>   for an attacker to attempt to cause a flood of reports toward the
>   domain identified in a signature's "d=" tag in one of these ways:
>
>   1.  Alter existing signatures by adding an "r=y" tag (and possibly
>       altering the "d=" tag to point at the target domain);
>
>   2.  Add a new but invalid signature bearing an "r=y" tag and a "d="
>       tag pointing at the target domain;
>
>   3.  Generate a completely new message bearing an "r=y" tag and a "d="
>       tag pointing at the target domain.
>
>   Implementers are therefore strongly advised not to advertise that DNS
>   record except when reports desired, including the risk of receiving
>   this kind of attack.
>
>   Positive caching of this DNS reply also means turning off the flow of
>   reports by removing the record is not likely to have immediate
>   effect.  A low time-to-live on the record needs to be considered.
>
> How does that look?

And I've now seen it in context, in the -12 version.  Some typos in
there, but we'll let the RFC Editor sort it out.

But...
You're going to hate this, but I think the copious new text in section
8.2 really wants another paragraph.  In between the three numbered
items and this:

       Implementers are therefore strongly advised not to advertise that DNS
       record except when reports desired, including the risk of receiving
       this kind of attack.

...I'd like to see an extreme-case (but a very-possible-case) example, thus:

       Consider, for example, the situation if someone should send out a
       multi-million-message spam run, and include in the messages a fake
       DKIM signature containing "d=example.com; r=y".  It won't matter that
       those signatures couldn't possibly be real: each will fail verification,
       and any implementations that support this specification will report
       those failures, in the millions and in short order, to example.com.

I don't think the text that's there lays out the scary possibilities
clearly enough.  I think something like this does.

Barry