At 9:28 AM -0400 5/1/06, Tony Hansen wrote:
Or bite the bullet now and introduce hh (header hash)? It would act
exactly like bh (body hash), but be a hash of all headers except
dkim-signature. The signing algorithm would then be done over just the
dkim-signature header. This would make the header hash explicitly
present, simple to access, and easier to check against. If you wanted to
do additional heuristics, this is as opposed to getting the hash back as
a side effect of doing the signature verification and having to know
something about how rsa works on the inside.
Which is more confusing? :-) (If we were to hum right now, I'd hum for
making the header hash be explicit.)
I'm fine with either way. I think the chance that we will ever switch
from an RSA-based signature scheme of some sort is so remote that we
don't need it, but I agree with Eric that having an explicit hash
value is cleaner in case we do.
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html