Re: [apps-discuss] I-D Action: draft-ietf-appsawg-rfc5451bis-02.txt

Scott Kitterman <scott@kitterman.com> Fri, 17 May 2013 22:22 UTC

From: Scott Kitterman <scott@kitterman.com>
To: apps-discuss@ietf.org
Date: Fri, 17 May 2013 18:22:47 -0400
Message-ID: <1675160.H9MT8MA6B2@scott-latitude-e6320>
User-Agent: KMail/4.10.2 (Linux/3.8.0-21-generic; KDE/4.10.2; i686; ; )
In-Reply-To: <20130513045342.14228.40090.idtracker@ietfa.amsl.com>
References: <20130513045342.14228.40090.idtracker@ietfa.amsl.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
Subject: Re: [apps-discuss] I-D Action: draft-ietf-appsawg-rfc5451bis-02.txt
Precedence: list

On Sunday, May 12, 2013 09:53:42 PM internet-drafts@ietf.org wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Applications Area Working
> Group Working Group of the IETF.
> 
> 	Title           : Message Header Field for Indicating Message
> Authentication Status Author(s)       : Murray S. Kucherawy
> 	Filename        : draft-ietf-appsawg-rfc5451bis-02.txt
> 	Pages           : 42
> 	Date            : 2013-05-12

Comments:

>    At the time of publication of this document, Author Domain Signing
>    Practices ([ADSP]), SMTP Service Extension for Authentication
>    ([AUTH]), DomainKeys Identified Mail Signatures ([DKIM])>, Sender
>    Policy Framework ([SPF]), and Vouch-By-Reference ([VBR]) are
>    published DNS domain-level email authentication methods in common
>    use.  DomainKeys ([DOMAINKEYS]) and Sender ID ([SENDERID] are also
>    referenced here, though they respectively have "Historic" and
>    "Experimental" status, and are no longer common.

I've also seen iprev in the wild and it's supported by the python authres 
module I helped develop.  We've also implemented DMARC based on the latest 
draft.  Iprev is in 5451, so I think it should be mentioned.

>    Although SPF defined a header field called "Received-SPF" and
>    DomainKeys defined one called "DomainKey-Status" for this purpose,
>    those header fields are specific to the conveyance of their
>    respective results only and thus are insufficient to satisfy the
>    requirements enumerated below.  In addition, many SPF implementations
>    have adopted the header field specified below, and DomainKeys has
>    been obsoleted by DKIM.

I think this overstates things with respect to SPF.  Most implementations have 
not adopted authres and even in the cases where they have, it's an option, not 
the default.

In the ABNF:

I believe the change from:

authres-header = "Authentication-Results:" [CFWS] authserv-id
	[ CFWS version ]

to:

authres-header = "Authentication-Results:" [CFWS] authserv-id	
	[ [CFWS] "/" [CFWS] authres-version ]

is an incompatible change and if you really want to make it, you should bump 
the version number.  I checked and with authres, your example is mis-parsed.

	Authentication-Results: example.org/1; none

In this example, the authserv-id is "example.org", but authres, using the RFC 
5451 ABNF parses this and determines the authserv-id is "example.org/1"

If you want to make this change, I think it needs to be version 2 because an 
existing version 1 parser can't parse the header field anymore.  Actually, I'm 
not sure that helps since a version 1 parser would fail to determine the 
message version.  I think you need to specif a minimum of one space between 
the authserv-id and the "/" for backward compatibility.

The first two are editorial.  The last one is significant.  It's possible we 
implemented it wrong in authres, but that's how it looks for the moment.  
Let's discuss.

Scott K

[apps-discuss] I-D Action: draft-ietf-appsawg-rfc… internet-drafts
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Scott Kitterman
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Murray S. Kucherawy
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… John Levine
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Murray S. Kucherawy
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… John R Levine
[apps-discuss] Slash and version number in Authen… S Moonesamy
Re: [apps-discuss] Slash and version number in Au… Scott Kitterman
Re: [apps-discuss] Slash and version number in Au… Alexey Melnikov
Re: [apps-discuss] Slash and version number in Au… Dave Cridland
Re: [apps-discuss] Slash and version number in Au… Dave Cridland
Re: [apps-discuss] Slash and version number in Au… Scott Kitterman
Re: [apps-discuss] Slash and version number in Au… Dave Cridland
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Alessandro Vesely
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… John Levine
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Dave Crocker
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Barry Leiba
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Dave Crocker
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… John R Levine
Re: [apps-discuss] I-D Action: draft-ietf-appsawg… Murray S. Kucherawy