RFC 7070
An Architecture for Reputation Reporting
An Architecture for Reputation Reporting 🦋
Okay bestie, let's start with the title block 💖 This is RFC 7070, called An Architecture for Reputation Reporting, from the IETF stream. It was written by N. Borenstein (Mimecast) and M. Kucherawy. It's a Standards Track doc, ISSN 2070-1721, dated November 2013. The title block doesn't list anything it obsoletes or updates, so no drama there ✨
Abstract 🎀
This doc describes a general architecture for a reputation-based service, so you can request reputation-related data over the Internet. Here "reputation" means predictions or expectations about an entity or an identifier, like a domain name. It roughly follows the recommendations of RFC 4101 for describing a protocol model 💅
Status of This Memo ✨
This is an Internet Standards Track document 👑
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741 🌸
Info about the current status of this document, any errata, and how to give feedback on it can be found at http://www.rfc-editor.org/info/rfc7070 🧚
Copyright Notice 🌈
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date this document was published. Please read these documents carefully, because they explain your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 📜
Table of Contents 🍓
1. Introduction ....................................................3
2. Overview ........................................................4
3. Related Documents ...............................................5
4. High-Level Architecture .........................................5
4.1. Example of a Reputation Service Being Used .................6
5. Terminology and Definitions .....................................7
5.1. Application ................................................7
5.2. Response Set ...............................................7
5.3. Assertions and Ratings .....................................8
5.4. Reputon ....................................................9
6. Information Represented in the Protocol .........................9
7. Information Flow in the Reputation Query Protocol ..............10
8. Privacy Considerations .........................................10
8.1. Data in Transit ...........................................10
8.2. Aggregation ...............................................11
8.3. Collection of Data ........................................11
8.4. Queries Can Reveal Information ............................11
8.5. Compromised Relationships .................................11
9. Security Considerations ........................................12
9.1. Biased Reputation Agents ..................................12
9.2. Malformed Messages ........................................12
9.3. Further Discussion ........................................13
10. Informative References ........................................131. Introduction ✨
Historically, lots of Internet protocols have worked between unauthenticated entities. For example, an email message's author field (From:) [MAIL] can hold any display name or address, and the recipient or other agents along the delivery path don't verify it 🙈 Similarly, a server sending email with the Simple Mail Transfer Protocol [SMTP] trusts that the Domain Name System [DNS] led it to the intended receiving server. Both kinds of trust are easily betrayed, which opens the door to subversion of some kind and makes spam, phishing, and other attacks even easier than they'd otherwise be 💀
In recent years, explicit identity authentication mechanisms have started getting wider deployment. For example, the DomainKeys Identified Mail [DKIM] protocol lets you associate a validated identifier with a message. This association is cryptographically strong and is an improvement over the old state of affairs, but it doesn't tell good actors apart from bad ones 😭 Even when you can validate the domain name in an author field (e.g., trustworthy.example.com in john.doe@trustworthy.example.com), there's no basis for knowing whether it belongs to a good actor who deserves trust. As a practical matter, both bad actors and good ones adopt basic authentication mechanisms like DKIM. Honestly, bad actors tend to adopt them even faster than the good ones do, hoping some receivers will confuse identity authentication with identity assessment. The former only means the name is being used by its owner or their agent, while the latter makes a statement about the quality of the owner 🙃
With these authentication protocols around, it's possible to meet the need for a mechanism where mutually trusted parties can exchange assessment information about other actors. For these purposes, we can usefully define "reputation" as "the estimation in which an identifiable actor is held, especially by the community or the Internet public generally". (This is based on the definition of "reputation" in [RANDOMHOUSE].) We can call an aggregation of individual assessments "reputation input" 💜
The need for reputation services has been especially clear in the email world, where abuse is everywhere, but other Internet services are under attack too and may have a similar need. For instance, a reputation mechanism could be useful for rating the security of web sites, the quality of service from an Internet Service Provider (ISP), or an Application Service Provider (ASP). There are lots more opportunities too, like customer satisfaction at e-commerce sites, and even stuff that has nothing to do with Internet protocols, like plumbers, hotels, or books 📚 Just as humans have always relied on recommendations from trusted people in the physical world, they're expected to use reputation services in all kinds of Internet applications too 🌸
A full trust architecture covers a whole range of actors and activities, so you get an end-to-end service for creating, exchanging, and consuming trust-related information. One piece of that is a query mechanism for retrieving a reputation. Not every reputation service needs to convey the same information. Some only need to produce a basic rating, while others need to provide underlying detail. It's kind of like the difference between a check approval and a credit report 🎀
An overall reckoning of goodness versus badness can be defined generically, but specific applications will probably want to describe reputations for multiple attributes. An e-commerce site might be rated on price, speed of delivery, customer service, and so on, and could get very different ratings for each one. So the architecture defines a generic query mechanism and a basic format for reputation retrieval, but it allows extensions for each application 🫶
This architecture leaves out how a reputation-reporting agent collects such data and how it creates an evaluation. The mechanism defined here just lets you ask a question and get an answer. The rest of the overall service provided by such a reputation agent is specific to that service's implementation and is out of scope here 🙈
2. Overview 🌈
The basic premise of this reputation system is that a client wants to evaluate content based on an identifier associated with that content, and a reputation service provider collects, aggregates, and makes scores available for consumption based on the collected data. Typically, the client and service operators make some kind of agreement in which parameters are exchanged, such as: the location where the reputation service can be reached, the nature of the reputation data being offered, possibly some client authentication details, and the like 🤝
When the client gets some content it wants to evaluate (an Internet message, for example), it extracts one or more identifiers of interest from that content. Examples include the domain name found in the From: field of a message, or the domain name extracted from a valid DKIM signature 💅
Next, the goal is to ask the reputation service provider what the reputation of the extracted identifier is. The query contains the identifier to be evaluated and possibly some context-specific information (to establish the context of the query, e.g., an email message) or client-specific information. The client typically folds the data in the response into whatever local evaluation logic it applies to decide what disposition the content deserves ⭐
3. Related Documents 🧚
This document presents a high-level view of the reputation architecture 🦋
For sending and receiving reputation information, [RFC7071] defines a media type for containing responses to reputation queries, and a serialization format for that data (with examples). It also creates the registry for specific reputation contexts and the parameters related to them 🍓
[RFC7072] describes how to construct and issue reputation queries and replies in the context of this architecture, using the HyperText Transport Protocol (HTTP) as the query protocol 💜
Finally, [RFC7073] defines (and registers) a first, common reputation application, namely the evaluation of portions of an email message as subjects for reputation queries and replies 👑
4. High-Level Architecture 🔥
This document outlines the reputation query and response mechanism. It provides the following definitions:
- Vocabulary for the current work and work of this type;
- The types and content of queries that can be supported;
- The extensible range of response information that can be provided;
- Query/response transport conventions.
It provides an extremely simple query/response model that can be carried over a variety of transports, including the Domain Name System. (Although not typically thought of as a 'transport', the DNS provides generic capabilities and can be thought of as a mechanism for transporting queries and responses that have nothing to do with Internet addresses, such as is done with a DNS BlockList [DNSBL].) Each specification for Repute transport is independent of any other specification 🌸
The precise syntaxes of both the query and response are application specific. An application within this architecture defines the parameters available to queries of that type, and it also defines the data returned in response to any query 🧁
Part 2 picks up with Section 4.1, bestie 🦋💖
4.1. Example of a Reputation Service Being Used 💅
okay so a reputation mechanism is literally just one piece of a bigger service 🎀 a good example is an email system that uses DKIM [DKIM] to stick a stable identifier on a message and then uses that identifier to decide how to treat it ✨
+-------------+ +------------+
| Sender | | Recipient |
+-------------+ +------------+
| ^
V |
+-------------+ +------------+
| MSA | | MDA |
+-------------+ +------------+
| ^
| |
| +------------+
| | Handling |
| | Filter |
| +------------+
| ^
| |
| +------------+ +------------+
| | Reputation |<=====>| Identifier |
| | Service | | Assessor |
| +------------+ +------------+
| ^
V |
+------------+ Responsible Identifier +------------+
| Identifier |. . . . . . . . . . . . . .>| Identifier |
| Signer | (DKIM) | Verifier |
+------------+ +------------+
| ^
V |
+-------------+ /~~~~~~~~~~\ +------+-----+
| MTA |----->( other MTAs )------>| MTA |
+-------------+ \~~~~~~~~~~/ +------------+Figure 1: Actors in a Trust Sequence Using DKIM
see [EMAIL-ARCH] for the general vibe of the Internet messaging architecture 📬 it's where the terms Message Submission Agent (MSA), Message Delivery Agent (MDA), and Message Transfer Agent (MTA) get explained, so go there if you need the full lore 🧚
in the figure, the solid lines show the flow of a message 💌 the dotted line shows validated identifiers moving around inside the message content 🫶 and the double line is the query and response for the reputation info 🔥
so here's the tea 🍓 the DKIM Service hands out one or more stable identifiers, and those become the basis for the reputation query. when a message arrives from an MTA, the DKIM Service gives back a (possibly empty) set of validated identifiers (domain names, in this case) and those are the subjects the Identifier Assessor asks about. the Identifier Assessor then asks a Reputation Service what the reputation of those identifiers is, and passes the identifiers plus their reputations along to the Handling Filter. the Handling Filter makes the final call on whether and how the message gets delivered to the recipient, using these inputs plus other info about the message, and it might even use other checks besides DKIM 👑 main character energy for sure
5. Terminology and Definitions 🎀
this section defines the terms used in the rest of the document, so bookmark it bestie 🔖
5.1. Application 🍿
an "Application" is a specific context where reputation queries get made. the obvious popular examples are restaurants, movies, or providers of various services 🍕
different Applications care about different attributes 💭 so the subjects of queries and the responses are gonna vary too, since they're describing the reputations of entities in their own contexts. for example, the Application "movies" would have a totally different set of properties of interest and associated ratings (see below) from "restaurants" 🎬 which is exactly why they have to be formally defined 📜
5.2. Response Set 🦋
a "Response Set" is a way of representing data that gets returned in response to a reputation query about a particular entity within the context of an Application. every Response Set will always contain at least these components:
- the name of the entity being rated;
- the Assertion (see Section 5.3);
- the Rating (see Section 5.3).
the full content of the Response Set is specific to the Application 💖 all Applications share these few key Response Set fields, but the reputation data returned when evaluating email senders would look different from what you'd get for a movie, a restaurant, or a baseball player ⚾ and the specific meaning of a Rating is also specific to each Application 🌈
a Response Set gets declared in a specification document, along with a symbolic name for the Application. those specifying documents include the details of the query parameters and responses that are particular to that Application 📄 the symbolic names and their specifying documents get registered with IANA in the "Reputation Applications" registry, so nobody collides on names and everyone has a handy reference to the docs 🧚
IANA registries are created in [RFC7071].
5.3. Assertions and Ratings ⭐
one of the key properties of a Response Set is called an "Assertion" 💜 assertions are claims made about the subject of a reputation query. for example, you might assert that a particular restaurant serves good food 🍓 in this architecture, the assertion would be "serves good food".
assertions come paired with a numeric value called a "Rating" 🔥 the Rating shows how much the party generating the Response Set agrees with the assertion. Ratings are typically expressed as a floating point value between 0.0 and 1.0 inclusive, where the former means no support for the assertion and the latter means total agreement 💯
the documents that define future applications will also specify the type of scale used when generating ratings, and every reputation service provider in that application space has to stick to it 🫶 this lets a client switch which reputation service provider it queries without having to figure out through some out-of-band method what the new provider's ratings mean ✨ for example, a registration might state that ratings are linear, which would mean a score of "x" is twice as strong as a value of "x/2" 📈 it also makes it way easier to aggregate ratings collected from multiple reputation service providers 🎀
5.4. Reputon 🦋
a "reputon" is an object that makes up the basic response to a reputation query 💌 it holds the Response Set relevant to the subject of the query, in a serialized form. its specific encoding is left up to the documents that implement this architecture 🧚
6. Information Represented in the Protocol 🍓
no matter which transport gets picked for the interchange, the basic information to be represented in the protocol is pretty simple, and it normally includes at least the following data 💅
in the query:
- the subject of the query;
- the name of the reputation context ("Application"; see Section 5.1);
- optionally, name(s) of the specific reputation assertions of interest.
different transports, or different reputation contexts, might need additional query parameters 🌸
in the response:
- the identity of the entity providing the reputation information;
- the identity of the entity being rated;
- the application context for the query (e.g., email address evaluation);
- the overall rating score for that entity.
beyond this, arbitrary amounts of additional information might be included for specific uses of the service 🌈 the entire collection of data found in the response is the Response Set for that application, and it's defined in specifying documents like we talked about above 📚
for example, a specification might be needed for a reputation Response Set for an "email-sending-domain" 📧 the Response Set might include info on how often spam was received from that domain 🙈
[RFC7071] defines a media type and format for reputation data, and [RFC7072] describes a protocol for exchanging such data 🎀
7. Information Flow in the Reputation Query Protocol 🦋
the basic Response Set could be wrapped into a new MIME media type [MIME] or a DNS Resource Record (RR), and transported accordingly ✨ it could also be the integral payload of a purpose-built protocol 🧚 in a basic request/response scenario, one entity (the client) asks a second entity (the server) for reputation data about a third entity (the subject), and the second entity responds with that data 💌
an application might benefit from an extremely lightweight mechanism that supports constrained queries and responses, while others might need to support larger and more complex responses 👑
8. Privacy Considerations 🙈
8.1. Data in Transit 🔒
some reputation exchanges can be sensitive and should not be shared publicly 🫣 a client using this framework is explicitly revealing that it's interested in particular subjects, and the server is revealing what its information sources have reported about those subjects (in the aggregate) 👀 in the email context, for example, a client is revealing who it gets email from, and the server is revealing what it (based on its aggregated data) believes to be true about those senders 💀
these can be sensitive things that need to be secured, especially when a client is talking to a server outside of its own administrative domain 😭 also, certain types of reputation information are typically seen as more sensitive than others 🍿 movie ratings, for example, are way less damaging if leaked than a person's credit rating 💅
for interchanges that are sensitive to these exposures, it is imperative to protect the information from unauthorized access and viewing, and possibly add the capability to do object-level integrity and origin verification 🔐 not all transport options can be adequately secured in these ways 🚨 in particular, DNS queries and responses are entirely insecure 💔 services need to use a transport method that provides adequate security when privacy-sensitive data is involved 🫶
the architecture described here neither suggests nor precludes any particular transport mechanism for the data 🌈 an HTTP mechanism is defined in [RFC7072], and email-based mechanisms are also envisioned 📬 for HTTP, use of HTTP over Transport Layer Security [HTTP-TLS] is very strongly advised 🔥 for email, mechanisms such as OpenPGP [OPENPGP] and S/MIME [SMIME] are similarly advised ✨
8.2. Aggregation 🧁
the data collected as input to a reputation calculation is, in essence, a statement by one party about the actions or output of another 🗣️ what one party says about another is often meant to be kept in confidence 🤫 so steps often need to be taken to secure the submission of these input data to a reputation service provider 🔐
and although the aggregated reputation is the product this service provides, its inadvertent exposure can have undesirable effects 😬 just as collecting data about a subject needs due consideration for privacy and security, so does the output and storage of whatever aggregation the service provider applies 🫶
8.3. Collection of Data ✨
okay so collecting and storing reputation data is obviously a privacy issue 😭 like, the opinions one party holds about another are usually sensitive stuff. if those data get exposed by accident or to someone who shouldn't see them, it can cause personal or commercial damage 💔
8.4. Queries Can Reveal Information 🕵️♀️
when a client asks a service provider about a particular subject, the provider can figure out that the subject exists and start watching which clients keep asking about it 👀 and that can be a sneaky, unexpected leak of private info. not cute 🙈
8.5. Compromised Relationships 🔐
reputation services that only answer authorized clients can accidentally reveal private stuff, like the reputations themselves or the data used to compute them, if a client's credentials get compromised 😱 so it's super important to protect not just the trade of reputation info and the info once it's been delivered to the client, but also the ability to send requests for info in the first place 🛡️
ngl the wild part is that compromised credentials mostly expose some third party (the one whose reputation gets improperly revealed) rather than the client or the server 🥺 the person getting hurt isn't even in the room, bestie 💔
9. Security Considerations 🛡️
this document introduces an overall protocol architecture but no implementation details 📐 so the security considerations here are very high level 🌸 the detailed analysis of the specific components can be found in the documents that actually instantiate this architecture 💅
9.1. Biased Reputation Agents 🎭
okay this one is giving main character drama 😤 same as with [VBR], an agent using a reputation reporting service is putting some trust in the service to give an unbiased "opinion" about the object being looked up 🤞 the whole point is that the data guides whatever action the reputation client takes next, so if the service is biased, the client can get hurt 😬 clients need to be aware of this possibility and of the effect it might have 👀
for example, say a biased system returns a reputation for a DNS domain found in email messages. it could let spam, phishing, or malware through a mail gateway by rating the domain more favorably than it deserves 📧💀 or it could cause mail to be needlessly rejected or delayed by rating the domain more unfavorably than it deserves 😩
as a possible mitigation, clients might try to only interact with reputation services that disclose at least some of the computation methods behind the results they return 🧠 but honestly, that disclosure and its evaluation are beyond the scope of this document, so we're leaving that one for another day 🫶
similarly, a client that trusts the results from such a service could get burned if the service itself is compromised 😱 an attacker could control it and return biased results without the agency running the reputation service knowing anything about it 🚨 that could happen through an attack on the data at the source, or through a man-in-the-middle attack 🕷️ so protocols need to be designed to be as resilient against these attacks as possible 💪✨
9.2. Malformed Messages 💌
both clients and servers of reputation systems need to be resistant to attacks involving malformed messages, whether they're deliberate or not 😵 malformations can be used to confuse clients and servers alike when it comes to figuring out which party or parties are responsible for the content being evaluated 🌀 and that can end up delivering undesirable or even dangerous content 🚫
9.3. Further Discussion 🧚
involving a third party (here, a reputation service provider) that can influence how incoming content gets handled means handing over some amount of control to that third party 🎀 there are plenty of other topics about managing, operating, and safely using reputation systems, and those live in [CONSIDERATIONS] 📚
10. Informative References 📖
[CONSIDERATIONS]
Kucherawy, M., "Operational Considerations Regarding
Reputation Services", Work in Progress, May 2013.
[DKIM] Crocker, D., Ed., Hansen, T., Ed., and M. Kucherawy,
Ed., "DomainKeys Identified Mail (DKIM) Signatures",
STD 76, RFC 6376, September 2011.
[DNS] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
[DNSBL] Levine, J., "DNS Blacklists and Whitelists", RFC 5782,
February 2010.
[EMAIL-ARCH]
Crocker, D., "Internet Mail Architecture", RFC 5598,
July 2009.
[HTTP-TLS] Rescorla, E., "HTTP Over TLS", RFC 2818, May 2000.
[MAIL] Resnick, P., Ed., "Internet Message Format", RFC 5322,
October 2008.
[MIME] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
Extensions (MIME) Part One: Format of Internet Message
Bodies", RFC 2045, November 1996.
[OPENPGP] Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R.
Thayer, "OpenPGP Message Format", RFC 4880,
November 2007.
[RANDOMHOUSE]
"Random House Webster's Dictionary, Revised Edition",
ISBN 978-0-345-44725-8, June 2001.
[RFC7071] Borenstein, N. and M. Kucherawy, "A Media Type for
Reputation Interchange", RFC 7071, November 2013.
[RFC7072] Borenstein, N. and M. Kucherawy, "A Reputation Query
Protocol", RFC 7072, November 2013.
[RFC7073] Borenstein, N. and M. Kucherawy, "A Reputation Response
Set for Email Identifiers", RFC 7073, November 2013.
[SMIME] Ramsdell, B. and S. Turner, "Secure/Multipurpose Internet
Mail Extensions (S/MIME) Version 3.2 Message
Specification", RFC 5751, January 2010.
[SMTP] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321,
October 2008.
[VBR] Hoffman, P., Levine, J., and A. Hathcock, "Vouch By
Reference", RFC 5518, April 2009.Authors' Addresses 📮
Nathaniel Borenstein
Mimecast
203 Crescent St., Suite 303
Waltham, MA 02453
USA
Phone: +1 781 996 5340
EMail: nsb@guppylake.com
Murray S. Kucherawy
270 Upland Drive
San Francisco, CA 94127
USA
EMail: superuser@gmail.comthat's the whole thing, bestie 🌈💖 you made it through all of RFC 7070 🎉👑
📦 where this page comes from
- ietf: rfc7070 2013-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms