Subject: [dmarc-ietf] Open issue: mandatory signing of AAR[n] by AMS[n]

From: Kurt Andersen <[email-masked]>
Date: Wed, 19 Jul 2017 13:28:52 +0200

The spec currently calls for the n-th instance of AAR to be signed by the
related AMS[n] header as well as the AS[n] header.

There have been some offlist discussions about whether that is really
necessary, and, generally the conclusion was that it is not really
necessary to the integrity of the mechanism to have the AAR incorporated
into the signed space for both AMS and AS.

The question to the list (and one which we will also raise in the meeting
on Thursday @ IETF) is whether to change the spec to make the signing of
AAR[n] by AMS[n] optional.

It won't break any current implementations and apparently will make some
deployments easier (I'll have to let Seth and Gene chime in with details)
so I'm inclined to make the change.

Opinions?

--Kurt

---

From: Seth Blank <[email-masked]>
Date: Wed, 19 Jul 2017 04:34:10 -0700

There has been an on-list discussion about this, but in it no consensus was
reached:
https://mailarchive.ietf.org/arch/msg/dmarc/KvpNpf_9ywZpK6oMcwJ1OJthiHM

Off list the consensus from those I've spoken with (which is obviously not
necessarily representative of the WG) is that we should drop the language
suggesting coverage of the AAR by the AMS, as this adds no value when the
AAR is required to be signed by the AS.

Personally, I think removing this (so only the AS covers the AAR)
simplifies the spec and implementations without removing value from the
protocol.

On Wed, Jul 19, 2017 at 4:28 AM, Kurt Andersen <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 19 Jul 2017 14:07:16 +0200

On Wed, Jul 19, 2017 at 1:34 PM, Seth Blank <[email-masked]> wrote:

> There has been an on-list discussion about this, but in it no consensus
> was reached: https://mailarchive.ietf.org/arch/msg/dmarc/
> KvpNpf_9ywZpK6oMcwJ1OJthiHM
>

I concur.

-MSK

---

From: Gene Shuman <[email-masked]>
Date: Wed, 19 Jul 2017 11:18:39 -0700

I also very much believe this language should be removed, as it's
unnecessary complexity.

On Wed, Jul 19, 2017 at 5:07 AM, Murray S. Kucherawy <[email-masked]>
wrote:

>> was reached: https://mailarchive.ietf.org/arch/msg/dmarc/KvpNpf_
>> 9ywZpK6oMcwJ1OJthiHM
>>
>> Off list the consensus from those I've spoken with (which is obviously
>> not necessarily representative of the WG) is that we should drop the
>> language suggesting coverage of the AAR by the AMS, as this adds no value
>> when the AAR is required to be signed by the AS.
>>

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Thu, 20 Jul 2017 06:58:27 +0200

Ack - consider it done and I'll report as such in this morning's session.
Thanks for weighing in.

--Kurt

---

From: Gene Shuman <[email-masked]>
Date: Wed, 19 Jul 2017 22:00:41 -0700

Great.  AFAIK, this was the last remaining technical issue in the spec.
I'm very happy to see things reach this point.

On Wed, Jul 19, 2017 at 9:58 PM, Kurt Andersen (b) <[email-masked]> wrote:

>> On Wed, Jul 19, 2017 at 5:07 AM, Murray S. Kucherawy <[email-masked]
>> > wrote:
>>

---

From: Gene Shuman <[email-masked]>
Date: Wed, 19 Jul 2017 22:29:53 -0700

Accept, after checking my email further, these new ideas about the AAR.
But I expect/hope this is something we can resolve quickly.

On Wed, Jul 19, 2017 at 10:00 PM, Gene Shuman <[email-masked]> wrote:

>>> On Wed, Jul 19, 2017 at 5:07 AM, Murray S. Kucherawy <
>>> [email-masked]> wrote:
>>>
>>>>> There has been an on-list discussion about this, but in it no
>>>>> consensus was reached: https://mailarchive.i
>>>>> etf.org/arch/msg/dmarc/KvpNpf_9ywZpK6oMcwJ1OJthiHM
>>>>>