On July 31, 2005 at 14:37, Dave Crocker wrote:
Since the i= tag does not have to equal From, how
does the verifier know exactly what the signature is bound to?
Why does the verifier have to know exactly what the signature is bound to?
Spoofing. See my previous posts about this.
Why does the signature have to be bound to the address in any other field?
Mailing list usage scenarios.
How is the sigature to be used, so that such binding is required?
See previous posts and threads discussing this.
--ewh