Hi all,
I'm one of the authors of the DKIM protocol and it recently came to
my attention that you've recently changed mailman to remove DK and
DKIM signature headers when you remail the message. This is incorrect
behavior:
in Section 4:
Signers SHOULD NOT remove any DKIM-Signature header fields from
messages they are
signing, even if they know that the signatures cannot be verified.
This actually applies to everybody. There are several reasons for this.
First
is that DKIM allows you to specify the length of a body so it is not the
case
a priori that mailman will destroy the signature. Second, other
heuristics can
be applied to make mailing list traversal even better such as using the
z= tag
to determine whether trivial subject modifications have been made. Third and
probably most important is that removing the signature is actually
harmful rather
than helpful: a broken signature and a missing signature MUST be treated as
equivalent to no signature at all (lest an attacker just add a fake
DKIM-signature
header to get preferential treatment), and as above the verifier loses
the ability
to recover the signature.
Just as an FYI, we have deployed DKIM across all of Cisco and our successful
mailing list traversal rate is about 99% -- a large percentage of which
are through
mailman lists. By making this change, you've taken the verify rate from
99% to
0% in one swell foop. Not good.
Mike
_______________________________________________
Mailman-Developers mailing list
Mailman-Developers@python.org
http://mail.python.org/mailman/listinfo/mailman-developers
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives:
http://www.mail-archive.com/mailman-developers%40python.org/
Unsubscribe:
http://mail.python.org/mailman/options/mailman-developers/archive%40jab.org
Security Policy:
http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq01.027.htp
