DKIM and email address proof-of-control

[Lachlan Gunn]

Hi, thanks for the response.

> The links you provided point out that DKIM certifies only the domain
> of the email address, not the user part. The From address in the email
> header may not be the same as the MAIL FROM part of the SMTP dialogue.
> It might be that the first is trusted at example.com while the second is
> attacker at example.com. And both may differ from the credentials used to
> sign into the SMTP server.

That is true.  My feeling that this is not a problem is based on two
arguments:

1. Domain validation is fine because whoever controls the domain
ultimately determines which user has which address.  Any form of email
validation is vulnerable to this, the best you can do is to try to
detect such tampering by forcing them to put a public key onto SKS or
such.  This is still much better than what we have now, where we just
have to trust that the Robot CA hasn't misissued a signature, an
attacker needs to at least compromise each domain separately.

2. With Gmail at least, the From seems to be replaced with the account
that I log in from, yielding the following (lachlan at twopif.net is a
Google Apps address):

    From: Lachlan Gunn <lachlan at twopif.net>
    X-Google-Original-From: Lachlan Gunn <lachlan.gunn at gmail.com>

I would have thought that any sane MTA would do either this or outright
reject such an email, but maybe I'm overoptimistic.  This is why I meant
that whitelisting might be a good idea---if it is known that they have
anti-spoofing measures in place then their signature has value, if not
then no.

> IMHO, no. What about:-
> 
>       reply numbering, such as "Re[2]:"?
> 
>       Non-english versions, such as "Aw:"?
> 
>       changed subject lines, for example to begin with a help ticket
>       number or simply to make the subject match the content?

I guess I should clarify this to mean that the subject would have to be
"VALIDATE-EMAIL-F3E3..." without any other text around it.  Dashes are
there so that misleading spacing cannot be canonicalised away.  Subject
lines wouldn't ever be changed and expected to remain valid, because the
process would be "Send a blank email with the subject line
"VALIDATE-EMAIL-<your fingerprint>".

Thanks again for your comments,
Lachlan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20160802/edd75613/attachment.sig>