On Fri, 2005-01-14 at 19:48 +0000, John Levine wrote:
Well, the signature can say which address it signed.
That's not sufficient though, surely?
If you get a message with 'Resent-From: dwmw2(_at_)infradead(_dot_)org' and
'Sender: owner-ietf-mailsig(_at_)imc(_dot_)org', where the address
'dwmw2(_at_)infradead(_dot_)org' has published that it'll always sign mail but
there's no valid signature from that address... do you accept that mail?
The answer is that you should accept it if the Resent-From: header is
newer than the Sender:, but not if the Sender: is newer. If you can't
decide which is newer you have to give the benefit of the doubt.
A real person would obviously look at the RFC2821 sender address but
we've decided we don't want to use that.
--
dwmw2