Subject: [marf] rd= Reporting Domain Tag In draft-ietf-marf-dkim-reporting

From: Scott Kitterman <[email-masked]>
Date: Sat, 28 Jan 2012 10:14:55 -0500

In draft-ietf-marf-spf-reporting we changed the address construction rules to 
use a localpart from the new mechanism published in DNS and the SPF domain in 
order to limit the abilty of random third parties to point this kinds of 
reports at unrelated receivers who may not be prepared for them (and retired a 
security consideration in the process).

We did not (I now notice, thanks to Alessandro Vesely's not on the subject in 
the SPF draft, make a similar change in the DKIM draft.  I think we should.

My proposal is to drop 3.1.  Extension DKIM Signature Tag and change the 
address construction in the ra= tag to use the signing domain (d=) in the 
signature.  In this manner the reports will only go back where they came from 
(in a general sense).

Scott K

---

From: Alessandro Vesely <[email-masked]>
Date: Sun, 29 Jan 2012 14:31:38 +0100

> signature.  In this manner the reports will only go back where they came from 

Murray introduced 3.1 after John pointed out an attack path in
http://www.ietf.org/mail-archive/web/marf/current/msg01775.html

I guess this feature is needed in order to account for message streams
<http://tools.ietf.org/html/rfc6377#section-2.5>, but I'm looking
forward to Murray's word on this.

The general statement seems to be that <[email-masked]> is
a valid address for reporting _something as long as there is a RR that
says

  _report._something.example.com. TXT "[...]whatever-local[...]"

Correct?

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 29 Jan 2012 19:07:16 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Scott Kitterman
> Sent: Saturday, January 28, 2012 7:15 AM
> To: [email-masked]
> Subject: [marf] rd= Reporting Domain Tag In draft-ietf-marf-dkim-reporting
> 
> My proposal is to drop 3.1.  Extension DKIM Signature Tag and change
> the address construction in the ra= tag to use the signing domain (d=)
> in the signature.  In this manner the reports will only go back where
> they came from (in a general sense).

The point of the extension tag is to add an active signal that the extra DNS work is supposed to be done to determine the reporting address.  Absent that, any Verifier participating in reporting will query the DNS of the signing domain for a reporting address, even for signatures that don't claim to request reporting.

I suppose it's not a huge difference though (i.e., if you want to make the attack, just include the "rd=" tag too).

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 29 Jan 2012 19:14:38 -0800

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Sunday, January 29, 2012 5:32 AM
> To: [email-masked]
> Subject: Re: [marf] rd= Reporting Domain Tag In draft-ietf-marf-dkim-reporting
> 

Yes, though I think I agree that being able to include an alternate domain name in the algorithm creates more exposure than it fixes, so rather than "rd=domain", we should just have "r=y" in the DKIM reporting document.

I'll do this in -07 unless there's a better idea.

-MSK