Subject: [dmarc-ietf] Progress of ARC documents

From: Barry Leiba <[email-masked]>
Date: Wed, 5 Oct 2016 10:35:04 -0400

We haven't had much discussion of the ARC documents recently, so...

Kurt, what's the status of the documents?  Do you have an issues list?
 Do you have material for updated drafts?  Is there discussion you
want to start or follow up on?

Working group:
Have all of you reviewed the ARC documents?  Does the dearth of
discussion of them mean they're close to ready?

Barry, DMARC WG chair

---

From: Hector Santos <[email-masked]>
Date: Sat, 15 Oct 2016 00:19:37 -0400

I wasn't too excited about this ARC work. Appeared to too complex, 
overkill to implement, required too much code change, hence lack of 
interest. stop reading long ago.

FWIW, I'm still waiting for a DMARC "proposal standard" work effort so 
we can get clean up the protocol, possibly get "Optional Policy 
Protocols" well described into it, with hopefully reintroducing some 
sponsored ADSP/ATPS or like plug and plug DNS policy work.  ARC can 
also be added to the third party signer solutions list.

--
HLS

On 10/5/2016 10:35 AM, Barry Leiba wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 15 Oct 2016 07:49:14 -0700

> discussion of them mean they're close to ready?

I've been working on an open source implementation.  It consists largely of
re-purposed code pulled from my open source DKIM stuff.  There's some final
plumbing I need to connect before it will be releasable.  I think the ARC
protocol, since it borrows so heavily from DKIM concepts, actually ends up
being less complex than it appears on paper.

There's at least one issue about the document that needs addressing, which
I believe has been raised already in some other context: The prefixing of
an instance number to the ARC-Authentication-Results field being described
only in prose leaves the proper syntax ambiguously defined.

More generally, I think the document needs quite a bit of polish.  The core
material seems to be there but I've got some qualms with its organization,
flow, etc.  This may also be contributing to a false veneer of complexity.
When I'm done the first round of coding, I'll route some energy toward
development of the document with the authors if they're amenable.

-MSK

---

From: Barry Leiba <[email-masked]>
Date: Sat, 15 Oct 2016 17:57:43 -0400

> development of the document with the authors if they're amenable.

The chairs would greatly appreciate that, Murray... please to, and we
know that Kurt's a delight to work with.

Barry

---

From: Kurt Andersen <[email-masked]>
Date: Mon, 17 Oct 2016 09:20:13 -0700

On Sat, Oct 15, 2016 at 7:49 AM, Murray S. Kucherawy <[email-masked]>
wrote:

> I've been working on an open source implementation.  It consists largely
> of re-purposed code pulled from my open source DKIM stuff.  There's some
> final plumbing I need to connect before it will be releasable.  I think the
> ARC protocol, since it borrows so heavily from DKIM concepts, actually ends
> up being less complex than it appears on paper.
>

Most of the recent work has been in regard to coordinating and testing the
four (4) known implementations of the ARC spec (Google, AOL, dkimpy,
OpenARC). They are each in various stages of completion/readiness for
production.

> only in prose leaves the proper syntax ambiguously defined.

Yes, known issue. I plan to have an update that clarifies this issue and
addresses a few nits submitted before the end of this week (Oct 21).

> More generally, I think the document needs quite a bit of polish.  The
> core material seems to be there but I've got some qualms with its
> organization, flow, etc.  This may also be contributing to a false veneer
> of complexity.  When I'm done the first round of coding, I'll route some
> energy toward development of the document with the authors if they're
> amenable.
>

Would be very happy to have any thoughts and input on making the document
more understandable and approachable.

--Kurt

---

From: "John Levine" <[email-masked]>
Date: 17 Oct 2016 19:18:47 -0000

>OpenARC). They are each in various stages of completion/readiness for

Any chance we could get a peek at dkimpy or OpenARC?  We understand that
they're beta software.

R's,
John

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 17 Oct 2016 15:26:34 -0400

> Any chance we could get a peek at dkimpy or OpenARC?  We understand that

I have started working on incorporating the patch that Brandon Long (Google) 
provided for dkimpy.  In order to incorporate it in a way that is maintainable 
and provides a stable API, it needs considerable rework (the actual ARC 
signing part seems to work fine).

I would prefer to keep in private until I'm done with the rework so that what 
people see is close to or the final API.  I don't think it'll take that long 
to do.  Additionally, the exact patch that was provided will be in the VCS 
history, so people can look at that too if they want.

Scott K