Re: [lamps] Draft addition of header protection to the LAMPS charter

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2019-01-04 12:06:35 -0500, John R Levine wrote:
> That doesn't strike me as a meaningful distinction.  We designed DKIM
> so polciy about assigning selectors and where signatures are added are
> out of scope.  On my mail system, every DKIM signature has a unique
> selector.

Hm, that creates an interesting metadata phone-home situation!  Thanks
for pointing it out.  and taugh.com is a signed zone as well.  So you're
re-signing your zone with every message sent, or do you have a batch of
pre-signed selectors, and you just tick them off and regenerate a batch
when you're running low?  (apologies for the off-topic nature here --
feel free to reply to me privately on this if you want).

> On the other hand, I'm pretty sure I know of systems where S/MIME 
> signatures are generated and checked in MTAs and mailing list packages.

yep, understood.  I know such systems exist.  How would you expect DKIM
signatures to interact with protected encrypted headers?  do you think
this should be part of the scope of this work in LAMPS?

> My preference would be to leave out the prior history catalog completely.

Leaving out the prior history catalog works for me, too.

     --dkg