DKIM2

Ali G(mail) is back on da mic to break down DKIM2 — the IETF draft rebuilding email authentication around a signed chain of custody, where every hop signs, every change is declared, and every bounce goes home. Five minutes of hip-hop spec exegesis straight from the IETF draft specs: --- https://inboxsendersclub.com/song/dkim2 --- Aiii. Restecp. Checkin' da signature, checkin' da chain. DKIM — da sequel. Still a draft, innit. Booyakasha. Check it. Back in da day it was 6376 DKIM one — solid, but it had a glitch Add a footer to da body? Dat's your body hash Touch da subject line? Header hash crash Legit mail get binned in wid da trash Den arc turn up sayin' "trust me, it was nice" Experiment concluded — now we do it precise Change da text or da envelope, you sign what you done Only a see-through relay get to skip dat one Chain of custody, dat's da headline act "mf" is da MAIL FROM, base64, exact "rt" is da RCPT TO, every place it go Angle brackets included, dat's da envelope, bro Last man's "rt" gotta carry da next man's "mf" Domain match only — strip da labels from da left Da live envelope gotta match da top one exact Local part and all, dat's da replay contract "i equals one" is da Originator hop Every forward add one more, da numbers never stop Receive on one domain, send out on anuvva? "nd" name da next one — imaginary cover No "mf", no "rt" when da "nd" is dere But da next "d" better match, or da chain go bare Hash da body, hash da head, sign da chain DKIM two — every hop again "i", "m", "t", "d", "s" — dem is mandatory Replay leave a trail all down da chain of custody Wicked. Hash da body, hash da head, sign da chain D-K-I-M two — every hop again "i", "m", "t", "d", "s" — dem is mandatory Replay leave a trail all down da chain of custody Booyakasha. Message-Instance, dat's da other header field "m" is da instance number, count 'em as dey build "h" hold da hashes, SHA256 Header hash, colon, body hash — dat's da mix Forwarder touch nuffink? Da old signature ring Add a footer line and now you is a different ting You is a Reviser — "r" hold da recipe JSON, base sixty-four, tell 'em what it used to be "c" mean copy lines from here to dere "d" mean here's da literal I stuck in dere Header fields count up from da bottom of da pile Body lines count down — opposite style Wreck da body and you cannot rewind? Put a null, own it, hope dey still be kind Some header fields don't count, dem invisible "Received", "Return-Path" — trace, dat's da principle "Delivered-To", "Auth-Results" — dat's local chat "DKIM-Signature", "arc-dash" — ignore all dat Anything startin' "X-dash" is a private affair Don't sign it, don't count it, act like it ain't dere Message-Instance and da DKIM2 fields? Skip dem too Dey get signed separate — don't count nuffink twice, dat's da rule Lowercase da names, unfold da fold Header hash squash da spaces down to one, A to Z Signature canon kill every space instead Cos da signature only sign da DKIM2 line Everyting else ride inside da hash — dat's da design SHA256, dat's da hash you gotta hold Verifier MUST do RSA and ed25519, I'm told Key live in da DNS, same as it always been Selector, underscore-domainkey, dot da domain RSA 1024 bits, exponent 65537 Ain't no "v equals" — version numbers weren't heaven Break it in da future? Dey don't renumber, no Dey just call it DKIM 3. Dat's how it go. "t" is da timestamp, seconds since seventy 14 days on any hop? Dat's a drop, generally "n" is a nonce, 64 char max Only mean sometin' to da man who signed, dem's da facts "f" hold da flags — dey report and dey request "exploded": went to many. Mailin' list. Not a pest. "donotmodify": hands off da body and da head "donotexplode": one recipient, is what da signer said "feedback": tell me how it land "feedhere": route it back through me, understand? Ignore da request cos your policy say so? Fine — But dat copy never leave your house. Dat's da line. Now da bounce go back one hop, not to some random address To da "mf" of da man dat handed you da mess "mf" is empty? Angle bracket, bracket, done — Den you don't send nuffink. Not to no one. No more backscatter on a geezer who never knew PASS, FAIL, PERMERROR, TEMPERROR — dem is da four Fail da check inbound? No DSN no more So reject five-five-oh while da SMTP still run Key server down? 451. Crypto fail? Dat's done. Hash da body, hash da head, sign da chain DKIM two — every hop again "i", "m", "t", "d", "s" — dem is mandatory Replay leave a trail all down da chain of custody Wicked. Hash da body, hash da head, sign da chain DKIM two — every hop again "i", "m", "t", "d", "s" — dem is mandatory Replay leave a trail all down da chain of custody Wicked. Every hop dat change it, signs. Every change declared. Every bounce go home. Big up da IETF massive. Big up da DKIM workin' group. DKIM one ain't dead — DKIM two just don't look at it. Run bofe, innit. West Staines Massiv is signin' every hop. Respek.