ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] Deployment Non-Scenario 7: Cryptographic Upgrade and Downgrade Attacks

2007-02-27 06:11:05


Charles Lindsey wrote:
[big snip describing use of Magic s/w]
And then you have sufficient
information to decide whether it had failed because your Magic software
was inadequate, or because it was a bogus signature from a spammer.

Q.E.D.

Not quite. Whatever policy anyone publishes is public. Any spammer
can always replicate everything correctly with the exception of
the signature bits and thus create a message that appears to adhere
to policy but with a broken signature.

Seems to me that that's a *very* good reason to ignore the entire
FAILed signature and not to use any supposedly Magic s/w.

What have I missed?

Stephen.
_______________________________________________
NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html

<Prev in Thread] Current Thread [Next in Thread>