Dave Crocker wrote:
I believe we do need to have signature algorithm agility of some sort
for the reasons to do with hash weaknesses and also since there will
always be >1 favorite algorithm in a big world.
This scheme (or similar) may be a part of the way to provide that
agility. For now though, I don't understand well enough whether we
should worry about downgrade attacks when signing more than once.
having agility is different from adding mechanisms to defend against
attacks
against the use of that agility.
I agree.
S.
_______________________________________________
NOTE WELL: This list operates according to
http://dkim.org/ietf-list-rules.html