Re: [ietf-dkim] Choices about Practice vs. Publication

2007-07-19 Thread Douglas Otis
On Jul 14, 2007, at 7:23 PM, Dave Crocker wrote: Michael Thomas wrote: Dave Crocker wrote: I think a simple and appropriate model, here, is that the receive-side should be given information that permits it to detect external attacks -- that is, misbehaviors by actors external to the o

Re: [ietf-dkim] Choices about Practice vs. Publication

2007-07-16 Thread Dave Crocker
Michael Thomas wrote: Dave Crocker wrote: I think a simple and appropriate model, here, is that the receive-side should be given information that permits it to detect external attacks -- that is, misbehaviors by actors external to the origin-side. ... In which case, the bob and jane @

Re: [ietf-dkim] Choices about Practice vs. Publication

2007-07-08 Thread Douglas Otis
On Jul 8, 2007, at 4:46 PM, Steve Atkins wrote: On Jul 8, 2007, at 4:37 PM, Douglas Otis wrote: Steve pointed out to me that a basic challenge, here, is that DKIM does not define a signature as meaning that the signer is asserting the truthfulness of any particular bit of information

Re: [ietf-dkim] Choices about Practice vs. Publication

2007-07-08 Thread Steve Atkins
On Jul 8, 2007, at 4:37 PM, Douglas Otis wrote: Steve pointed out to me that a basic challenge, here, is that DKIM does not define a signature as meaning that the signer is asserting the truthfulness of any particular bit of information in the message. That's the inherent difference b

Re: [ietf-dkim] Choices about Practice vs. Publication

2007-07-08 Thread Douglas Otis
On Jul 8, 2007, at 11:42 AM, Dave Crocker wrote: An offline discussion with Steve Atkins has been helpful in highlighting a two distinctions in function and implementation design that the group should consider. He pressed quite hard, for some of what follows, but I won't claim that I'm sp

Re: [ietf-dkim] Choices about Practice vs. Publication

2007-07-08 Thread Michael Thomas
Dave Crocker wrote: 1. Internal vs. External The difference between recruiting the recipient to enforce origin-side policies concerning origin-side participants, versus enabling the recipient to detect misbehaviors by actors external to the origin-side. I think a simple and appropri

[ietf-dkim] Choices about Practice vs. Publication

2007-07-08 Thread Dave Crocker
An offline discussion with Steve Atkins has been helpful in highlighting a two distinctions in function and implementation design that the group should consider. He pressed quite hard, for some of what follows, but I won't claim that I'm speaking on his behalf; I just want to make sure it's cle