Re: Strict canonicalization considered harmful

From: Alessandro Vesely <vesely_at_tana.it>
Date: Fri, 12 Dec 2014 13:41:59 +0100

On Wed 10/Dec/2014 18:44:46 +0100 Murray S. Kucherawy wrote:
> On Wed, 10 Dec 2014, Alessandro Vesely wrote:
>>> Something is improperly wrapping long header fields, perhaps?
>>
>> Yes, but what does that? Are you sure you had simple c14n? It's enough to
>> check that the From: field came back with no added whitespace. For example,
>> I paste below the header returned from medusa. You can see the test passed,
>> because I have reverted to relaxed c14n, but the From: is munged, so it would
>> not have passed if c14n had been simple --the subject of this thread.
>
> I just repeated the test and once again it came back GOOD. The signature we
> sent to sendmail.net was:
>
> DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=blackops.org;
> s=medusa3; t=1418233169;
> bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;
> h=Date:From:To:Subject;
> z=Date:=20Wed,=2010=20Dec=202014=2009:39:12=20-0800=20(PST)|From:=2
> 0"Display=20phrase=20of=2049,=20so=20total=20line=20length=20is=20
> 76"=20<msk_at_blackops.org>|To:=20sa-test_at_sendmail.net|Subject:=20sim
> ple/simple=20test;
> b=BQafByRA7aF3ioxHdj8RaumKgCrgYaq6hTi1EJjS+tNkiPCkPJwy5x8qpILJwOvhu
> AaVcF2hQVNoNFwQhEipOkaWyhJtn3F/HQjsIqsqOZGBErFeADRYmLfwP+Owxo2Jf65
> evJyCswtF9S7uvqYHfsSvlszxv6DanGnhhZ+RDpk=
>
> So yes, it appears to pass with simple/simple when this is the test, as requested:

Thanks a lot Murray, I wouldn't have worked it out without your support. It's
my SMTP client who wraps the header by inserting newline + 2 spaces. Sendmail
then unwraps it, as mentioned in release notes (1996/09/26):

        Add SingleLineFromHeader option. If set, From: headers are coerced
                into being a single line even if they had newlines in them
                when read. This is to get around a botch in Lotus Notes.

The Apple server probably removes the two spaces as well. That was enough to
confuse me (considering that local BCCs don't go through the SMTP client and
thus are immune.)

Now I patched my smtp client, and it works. However, the opposite way around
still fails. I got a BAD by signing what I'd imagine Lotus Notes used to produce:

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tana.it; s=beta;
        t=1418387019; bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;
        h=Date:From:To:Subject;
        z=Date:=20Wed,=2012=20Dec=202014=2009:39:12=20+0100=20(CET)|From:=2
         0Alessandro=20Vesely=0D=0A=20=20<vesely_at_tana.it>|To:=20sa-test_at_sen
         dmail.net|Subject:=20simple/simple=20test=3B;
        b=SaeUcII4ZnGNvv9yUd3ZYyOwAz6ShuoTSy6VMlMDBYi/m9U54+8rOZOX1c3fLOLyu
         5+Ui1PKWAo2UUGdD7H0Hruy+Mk8DGaJZ8S90ktIhSMMLOYQRFliC2ClHxXflCiqZUk
         1feRv3QNUmoPl2SdmkkMXT1SKgGjKHJ77he4BvWI=

Ale
Received on Fri Dec 12 2014 - 12:42:13 PST