Subject: [dmarc-ietf] weak dkim canonicalization

From: Brandon Long <[email-masked]>
Date: Thu, 28 May 2015 16:08:19 -0700

We've been looking at weak dkim from the angle of reducing what's covered
by the signature... but unfortunately, that takes out the major parts of
the message that we care about.

I'm wondering if there is a different alternative.

This starts from the concept of the clean subject, similar to the
reply_regexp setting in mutt (
http://www.mutt.org/doc/devel/manual.html#reply-regexp).  In Gmail, this
same cleaning involves more, where we also strip Fwd type prefixes, as well
as list-prefixes [] and whitespace changes.

One could imagine a canonicalization of the subject which did something
similar, allowing for most list subject mangling to not affect the
signature for that header.  We'd probably also need to de-2047 the header
as well, so the processing was done on the user visible header, not the raw
header.

Maybe there's some phishing  or weirdness in allowing [whatever I want in
brackets] as a prefix, and there is the argument that given a large enough
user population, someone will fall for it... but its certainly better than
ignoring the subject completely.

Moving on to the body is more complicated.  I know the proposal for using
the l= to limit the size of the body that is signed, which could allow for
a footer to be added without breaking the signature.  With HTML, it's been
argued that the later part of the message could modify the viewability of
the signed part and do all sorts of nasty things, and that may be true.  We
might be able to specify a very specific format for footers, requiring both
an l= and that the rest matched that format, and maybe we could encode that
formating requirement as a canonicalization play, ie that a footer matching
the format would be removed during canonicalization, and one that doesn't,
isn't.  Obviously, this may require a lot of work on list admins to move
their footers to a matching format, though if its pure text, that may be
simple enough for the list software to handle.  One could also imagine that
an MUA could choose to only display the l= part by default, eliding the
rest the same way Gmail hides signatures and the like (ignore that I
mentioned that we should talk with the MUA folks, of course).

One could also sign the body as an independent mime part and force footers
into multipart/mixed addendums.

I realize both of these body changes require modifications to various
intermediate software, where the semi-point of the weak signatures was to
hope that it would pass unharmed and limit the scope of changes that would
be required.

The final hare brained idea I had was more in the scope of "is this
possible" without actually knowing that myself.

There are various fingerprinting type algorithms, is it possible to
construct a fingerprint algorithm which one could then sign, and require
the modified body to still match the fingerprint.  This may not be possible
in cases where the footer is significantly larger than the original message
text, and I'm pretty ignorant of the actual algorithms to know if any would
work in this case, but it seems to me that this is something we could pose
to people knowledgeable about work in that area to see if there is a
solution.

Now, the fingerprinting solution may end up being just a more generic
version of l=, ie it may allow for prefix and footers or rewriting links or
something.  And it probably wouldn't catch the HTML writing tricks, so
maybe all of that is less useful than one would hope.

Brandon

---

From: "John Levine" <[email-masked]>
Date: 30 May 2015 01:30:02 -0000

>I'm wondering if there is a different alternative.

When we were doing DKIM, we went around and around and around trying
to figure out what sort of modifications we could allow and still
consider messages to be "the same", with negligible success.

All we came up with was relaxed canon and l=NN.  The point of relaxed
was to allow for the sort of message tidying up that sendmail used to
do before people understood the distinction between mail submission
and mail relay.  It is my impression that these days it's rare to have
a message that passes relaxed that wouldn't also pass strict.  The
point of l= was to allow mailing lists to add footers, not so much
because we thought that would solve a lot of problems but because it
was the only thing we could think of that might solve one problem and
it was cheap to specify and implement.  Again, I don't get the
impression that it's used very much, and messages with l=N would
usually pass anyway.

Google has some great algorithms people, so maybe they can come up
with some essence of message fingerprint that works, but I'd be
surprised.  Anything that a mailing list might do to add innocuous
text to a message, a spammer can do the same but adding spam text.  I
don't see any way around that.  We can probably come up with a hack
for subject lines just because subject lines are so short, but I'd be
pretty surprised if anything more general were workable.  (Proposed
subject hack: add a new code to DKIM-Signature that says to use the
copied subject from z= when verifying the signature, but only if the
contents of that subject is a substring of the current subject.
De-MIME-ing is a quality of implementation issue.)

For my double signing hack, I'm coming at it from the other direction,
what problem are we trying to solve.  When AOL and Yahoo made their
unfortunate DMARC decisions, they had a very concrete problem to
solve.  They'd allowed crooks to steal address books, so Yahoo (or
AOL) users were getting spam with Yahoo addresses of people they knew,
sent from random botnets, not from Yahoo.  I believe that double
signing still solves 99.9% of that problem while allowing mailing
lists to do most of what they ordinarily do.

While it is true that a malicious re-signing mediator could still
delete the contents of a weakly signed message and replace it with
spam, this greatly decreases the attack surface.  The malicious party
has to have a recent real message in hand from the real author, and
the real author's mail system has fine grained control over who they
allow to re-sign.  Start with a heuristic about what domains are
likely to be mailing lists (something I know gmail has from the
comments in the aggregate reports), put weak signatures on mail sent
to them.  If a particular mediator's spamminess spikes, you can stop
putting weak signatures on mail to the bad actor without having to
break mail to everyone else.  

For incoming mail, the double signature allows you to tell the
difference between direct mail and mediated mail, with the double
signature not meaning that the mail is "real", but rather that it came
via someone with at least a weak relationship with the author so it's
likely non-horrible enough to be worth running through the normal spam
filters.

This does require heuristics and tuning, but so does any spam filter,
and what this does seems similar to what any spam filter does anyway.

R's,
John