Subject: Re: [marf] Adrian Farrel's No Objection on draft-ietf-marf-as-15: (with COMMENT)

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 25 Apr 2012 20:16:52 +0000

Hi Adrian,

> -----Original Message-----
> From: Adrian Farrel [mailto:[email-masked]]
> Sent: Wednesday, April 25, 2012 10:07 AM
> To: The IESG
> Cc: [email-masked]; [email-masked]
> Subject: Adrian Farrel's No Objection on draft-ietf-marf-as-15: (with
> COMMENT)
> 
> Adrian Farrel has entered the following ballot position for
> draft-ietf-marf-as-15: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-
> criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Forgive me, but doesn't section 8.2 say that forged abuse reports
> constitue a real problem and the two mechanisms available to protect
> against them may result in genuine abuse reports being discarded?

Yes to the first point.  The second point is true of all email, not just abuse reports; if the signer's infrastructure is causing signatures to break, there's no reason to trust the reports even though they bear some kind of signature.  The same goes for, say, a message from your bank that's signed but the signature fails to validate.

> Is the message here "chosse which you think might be the least worse
> problem" or is it "you should use DKIM and SPF, but be aware that you
> may lose some genuine reports"?

It's "You should use DKIM and/or SPF, but make sure they're working properly if you want to reap the benefits."

> I would have liked some clarification as to which message is being
> sent.

That section is only talking about reports.  Which part is unclear?

-MSK

---

From: "Adrian Farrel" <[email-masked]>
Date: Wed, 25 Apr 2012 21:31:48 +0100

Hi Murray,

Thanks for this...

> Yes to the first point.  The second point is true of all email, not just abuse reports;
> if the signer's infrastructure is causing signatures to break, there's no reason to
> trust the reports even though they bear some kind of signature.  The same goes
> for, say, a message from your bank that's signed but the signature fails to
> validate.
> 

Simply (to my reading - which you may ignore if you feel I am not reading clearly) that the thought you captured above is not clear.

I read a rather despairing statement that since DKIM and SPF might not be working it is a toss-up whether you have reports being discarded because the signature fails or reports being spoofed.

If this is "state of the art" for email systems then maybe there is nothing else to say.

It struck me, however, that reports are going to be consumed by automatic systems. If I get an email where the signature fails, I can perform all sorts of human verification of the email and make a judgement call on the validity of the email. A software system processing reports is less flexible and so more exposed.

Perhaps the clarity that is needed is the strong hint that "Therefore the use of DKIM and/or SPF is RECOMMENDED and it is important to ensure that the security infrastructure is working properly."

Cheers,
Adrian

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 25 Apr 2012 20:42:31 +0000

> Sent: Wednesday, April 25, 2012 1:32 PM
> To: Murray S. Kucherawy; 'The IESG'
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: Adrian Farrel's No Objection on draft-ietf-marf-as-15:
> (with COMMENT)
> 
> Simply (to my reading - which you may ignore if you feel I am not
> reading clearly) that the thought you captured above is not clear.
> 
> I read a rather despairing statement that since DKIM and SPF might not
> be working it is a toss-up whether you have reports being discarded
> because the signature fails or reports being spoofed.
> 
> It struck me, however, that reports are going to be consumed by
> automatic systems. If I get an email where the signature fails, I can
> perform all sorts of human verification of the email and make a
> judgement call on the validity of the email. A software system
> processing reports is less flexible and so more exposed.
> 
> Perhaps the clarity that is needed is the strong hint that "Therefore
> the use of DKIM and/or SPF is RECOMMENDED and it is important to ensure
> that the security infrastructure is working properly."

[Cc'd to the marf list so that they can check my math here]

I'm one of those people that's not a fan of normative language in Security Considerations, so how's this?:

   Perhaps the simplest means of mitigating this threat is to assert
   that these reports should themselves be signed with something like
   DKIM and/or authorized by something like SPF.  Note, however, that if
   there is a problem with the email infrastructure at either end, DKIM
   and/or SPF may result in reports that aren't trusted or even accepted
   by their intended recipients, so it is important to make sure those
   components are properly configured.  Use of both technologies in
   tandem can resolve this concern to agree since they generally have
   disjoint failure modes.

-MSK

---

From: "Adrian Farrel" <[email-masked]>
Date: Wed, 25 Apr 2012 21:54:17 +0100

wfm
thanks for listening
A

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Murray S. Kucherawy
> Sent: 25 April 2012 21:43
> To: [email-masked]; 'The IESG'
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: RE: Adrian Farrel's No Objection on draft-ietf-marf-as-15: (with
> COMMENT)
>

---

From: Barry Leiba <[email-masked]>
Date: Wed, 25 Apr 2012 16:55:59 -0400

>>    tandem can resolve this concern to agree since they generally have

"to a degree".

Took me a minute to figure that out.

b

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 25 Apr 2012 21:07:14 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Barry Leiba
> Sent: Wednesday, April 25, 2012 1:56 PM
> To: [email-masked]
> Cc: Murray S. Kucherawy; The IESG; [email-masked];
> [email-masked]; [email-masked]
> Subject: Re: Adrian Farrel's No Objection on draft-ietf-marf-as-15:
> (with COMMENT)
> 

Damn, you cracked my crypto.

-MSK