On Monday 21 August 2006 01:34, Jim Fenton wrote:
Scott Kitterman wrote:
Yes, but the fundamental operational problem will be to pick the correct
domain to sign with. You have to make that decision either way. The
basis upon which you make the decision is the same. I agree that the
result LOOKS less ambiguous with the NS delegation approach, but the
fundamental security issue is don't pick the wrong domain to sign with
and that's no different.
When using the "authorized signing domains" approach, the signer uses
its own domain name, not that of the domain doing the delegation. I
don't see where there is a choice for the signer to make (which is also
the source of the ambiguity).
We had been discussing the need to segregated authenticated traffic (where
authorization to use the 2822.From has been established) from other traffic
being signed by use of a subdomain. This is to avoid issues like your
mailing list concern. The authorized signing domain would be the subdomain
that the operator has designated for the purpose.
Scott K
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html